Windows Analysis Report
lem.exe

Overview

General Information

Sample name: lem.exe
Analysis ID: 1581175
MD5: 5782bea403267e4a6ddf82263332ed59
SHA1: 2c1967ed35f79ce390ee56f30fdfa6d97426c4c9
SHA256: 0f9003739fc0213ff837f03f9c1ce4c835e3aab255c94d388aefb9d9b985cb2d
Tags: exeVidaruser-lontze7
Infos:

Detection

Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Attempt to bypass Chrome Application-Bound Encryption
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Search for Antivirus process
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Yara detected Vidar stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Drops PE files with a suspicious file extension
Found API chain indicative of sandbox detection
Found many strings related to Crypto-Wallets (likely being stolen)
Monitors registry run keys for changes
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Browser Started with Remote Debugging
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://bijutr.shop/e3f Avira URL Cloud: Label: malware
Source: https://bijutr.shop/bx Avira URL Cloud: Label: malware
Found malware configuration
Source: 0000000D.00000003.2418360409.0000000004761000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199809363512", "Botnet": "m0nk3"}
Multi AV Scanner detection for submitted file
Source: lem.exe Virustotal: Detection: 11% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 85.4% probability
Uses 32bit PE files
Source: lem.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49959 version: TLS 1.0
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.245.216.205:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: lem.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: cryptosetup.pdbGCTL source: Inf.com, 0000000D.00000002.3274650017.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, 68QI5X.13.dr
Source: Binary string: cryptosetup.pdb source: Inf.com, 0000000D.00000002.3274650017.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, 68QI5X.13.dr
Source: C:\Users\user\Desktop\lem.exe Code function: 0_2_00406301 FindFirstFileW,FindClose, 0_2_00406301
Source: C:\Users\user\Desktop\lem.exe Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00406CC7
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A7DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 13_2_00A7DC54
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A8A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 13_2_00A8A087
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A8A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 13_2_00A8A1E2
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A7E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, 13_2_00A7E472
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A8A570 FindFirstFileW,Sleep,FindNextFileW,FindClose, 13_2_00A8A570
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A866DC FindFirstFileW,FindNextFileW,FindClose, 13_2_00A866DC
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A4C622 FindFirstFileExW, 13_2_00A4C622
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A873D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, 13_2_00A873D4
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A87333 FindFirstFileW,FindClose, 13_2_00A87333
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A7D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 13_2_00A7D921
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Microsoft\Windows\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Microsoft\ Jump to behavior
Source: chrome.exe Memory has grown: Private usage: 1MB later: 39MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.5:49768 -> 188.245.216.205:443
Source: Network traffic Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.5:49762 -> 188.245.216.205:443
Source: Network traffic Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 188.245.216.205:443 -> 192.168.2.5:49780
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 188.245.216.205:443 -> 192.168.2.5:49774
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199809363512
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /k04ael HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 23.44.201.19 23.44.201.19
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View IP Address: 162.159.61.3 162.159.61.3
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49959 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.209.72.40
Source: unknown TCP traffic detected without corresponding DNS query: 23.209.72.40
Source: unknown TCP traffic detected without corresponding DNS query: 23.209.72.40
Source: unknown TCP traffic detected without corresponding DNS query: 23.209.72.40
Source: unknown TCP traffic detected without corresponding DNS query: 23.209.72.40
Source: unknown TCP traffic detected without corresponding DNS query: 23.209.72.40
Source: unknown TCP traffic detected without corresponding DNS query: 23.209.72.40
Source: unknown TCP traffic detected without corresponding DNS query: 23.209.72.40
Source: unknown TCP traffic detected without corresponding DNS query: 23.209.72.40
Source: unknown TCP traffic detected without corresponding DNS query: 23.209.72.40
Source: unknown TCP traffic detected without corresponding DNS query: 23.209.72.40
Source: unknown TCP traffic detected without corresponding DNS query: 23.209.72.40
Source: unknown TCP traffic detected without corresponding DNS query: 13.89.178.27
Source: unknown TCP traffic detected without corresponding DNS query: 13.89.178.27
Source: unknown TCP traffic detected without corresponding DNS query: 13.89.178.27
Source: unknown TCP traffic detected without corresponding DNS query: 18.164.116.98
Source: unknown TCP traffic detected without corresponding DNS query: 18.164.116.98
Source: unknown TCP traffic detected without corresponding DNS query: 18.164.116.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.44.201.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.44.201.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.44.201.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.44.201.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.44.201.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.44.201.19
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown TCP traffic detected without corresponding DNS query: 13.89.178.27
Source: unknown TCP traffic detected without corresponding DNS query: 13.89.178.27
Source: unknown TCP traffic detected without corresponding DNS query: 13.89.178.27
Source: unknown TCP traffic detected without corresponding DNS query: 13.89.178.27
Source: unknown TCP traffic detected without corresponding DNS query: 13.89.178.27
Source: unknown TCP traffic detected without corresponding DNS query: 13.89.178.27
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A8D889 InternetReadFile,SetEvent,GetLastError,SetEvent, 13_2_00A8D889
Source: global traffic HTTP traffic detected: GET /k04ael HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: bijutr.shopConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /b?rn=1735279295840&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3918B198F66063F3328CA4FAF7676296&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /b2?rn=1735279295840&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3918B198F66063F3328CA4FAF7676296&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1AE10fc6589f9ad55d15d371735279297; XID=1AE10fc6589f9ad55d15d371735279297
Source: global traffic HTTP traffic detected: GET /c.gif?rnd=1735279295839&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=338156387e954518bddd6ad5da364bdb&activityId=338156387e954518bddd6ad5da364bdb&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=0A6FD663C8E04E24A976289B56E6D1F3&MUID=3918B198F66063F3328CA4FAF7676296 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3918B198F66063F3328CA4FAF7676296; _EDGE_S=F=1&SID=1DDB83DF79F56C08037C96BD787D6D0A; _EDGE_V=1; SM=T
Source: 0abb4798-9ad1-4876-a169-ff21bd97f0a9.tmp.27.dr String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log3.27.dr String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log3.27.dr String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log3.27.dr String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697911899.000051D800D5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697911899.000051D800D5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000011.00000003.2610390393.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2610572297.000051D800F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2610623348.000051D800F60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000011.00000003.2610390393.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2610572297.000051D800F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2610623348.000051D800F60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000011.00000002.2697486285.000051D800CA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697911899.000051D800D5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000011.00000002.2699819467.000051D8013E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2635630335.000051D8013E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2696868366.000051D800AB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000011.00000002.2699819467.000051D8013E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2635630335.000051D8013E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytcaogl equals www.youtube.com (Youtube)
Source: chrome.exe, 00000011.00000002.2696868366.000051D800AB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytcap equals www.youtube.com (Youtube)
Source: chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697911899.000051D800D5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000011.00000002.2699160374.000051D801148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698496579.000051D800E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000011.00000002.2699160374.000051D801148000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmlault equals www.youtube.com (Youtube)
Source: chrome.exe, 00000011.00000002.2698496579.000051D800E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt equals www.youtube.com (Youtube)
Source: chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: sAOREpcgcodbdSPJ.sAOREpcgcodbdSPJ
Source: global traffic DNS traffic detected: DNS query: t.me
Source: global traffic DNS traffic detected: DNS query: bijutr.shop
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic DNS traffic detected: DNS query: assets.msn.com
Source: global traffic DNS traffic detected: DNS query: c.msn.com
Source: global traffic DNS traffic detected: DNS query: api.msn.com
Source: unknown HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----U3E3EC2VAAAIEUKFK6XBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: bijutr.shopContent-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2758252832.000054E0003A8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2886763892.000051040482C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2758252832.000054E0003A8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2886763892.000051040482C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2758252832.000054E0003A8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2886763892.000051040482C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2758252832.000054E0003A8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2886763892.000051040482C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280
Source: lem.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: lem.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: lem.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: lem.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000011.00000002.2695161383.000051D800654000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: Subtle.9.dr, Inf.com.2.dr String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Subtle.9.dr, Inf.com.2.dr String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Subtle.9.dr, Inf.com.2.dr String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Subtle.9.dr, Inf.com.2.dr String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Subtle.9.dr, Inf.com.2.dr String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: lem.exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: lem.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: lem.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: lem.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: lem.exe String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: chrome.exe, 00000011.00000002.2693037132.000051D800076000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000011.00000003.2615532276.000051D8010C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2613239460.000051D800F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2616293329.000051D8010E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2616126954.000051D800F60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://jsbin.com/temexa/4.
Source: lem.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: lem.exe String found in binary or memory: http://ocsp.digicert.com0
Source: lem.exe String found in binary or memory: http://ocsp.digicert.com0A
Source: lem.exe String found in binary or memory: http://ocsp.digicert.com0C
Source: lem.exe String found in binary or memory: http://ocsp.digicert.com0X
Source: Subtle.9.dr, Inf.com.2.dr String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Subtle.9.dr, Inf.com.2.dr String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Subtle.9.dr, Inf.com.2.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Subtle.9.dr, Inf.com.2.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: chrome.exe, 00000011.00000003.2615532276.000051D8010C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2613239460.000051D800F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2696287556.000051D80095B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2616293329.000051D8010E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618312497.000051D80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618312497.000051D801264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2616126954.000051D800F60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618170710.000051D80100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2617923428.000051D800F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618046250.000051D800F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2615959644.000051D801118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2617969978.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2617902560.000051D800CBC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000011.00000003.2615532276.000051D8010C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2613239460.000051D800F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2696287556.000051D80095B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2616293329.000051D8010E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618312497.000051D80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618312497.000051D801264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2616126954.000051D800F60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618170710.000051D80100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2617923428.000051D800F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618046250.000051D800F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2615959644.000051D801118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2617969978.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2617902560.000051D800CBC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000011.00000003.2615532276.000051D8010C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2613239460.000051D800F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2696287556.000051D80095B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2616293329.000051D8010E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618312497.000051D80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618312497.000051D801264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2616126954.000051D800F60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618170710.000051D80100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2617923428.000051D800F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618046250.000051D800F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2615959644.000051D801118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2617969978.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2617902560.000051D800CBC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000011.00000003.2615532276.000051D8010C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2613239460.000051D800F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2696287556.000051D80095B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2616293329.000051D8010E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618312497.000051D80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618312497.000051D801264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2616126954.000051D800F60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618170710.000051D80100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2617923428.000051D800F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618046250.000051D800F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2615959644.000051D801118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2617969978.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2617902560.000051D800CBC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000011.00000002.2698251966.000051D800E18000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
Source: chrome.exe, 00000011.00000002.2696423318.000051D800984000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000011.00000002.2696423318.000051D800984000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certsQ
Source: Subtle.9.dr, Inf.com.2.dr String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Subtle.9.dr, Inf.com.2.dr String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: chrome.exe, 00000011.00000002.2696504993.000051D8009BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000011.00000002.2696504993.000051D8009BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/6
Source: Inf.com, 0000000D.00000002.3271632113.0000000000AE5000.00000002.00000001.01000000.00000007.sdmp, Silicon.9.dr, Inf.com.2.dr String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: lem.exe String found in binary or memory: http://www.digicert.com/CPS0
Source: chrome.exe, 00000011.00000003.2659699616.000051D800E68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698393314.000051D800E6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2633307189.000051D800E68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2655794275.000051D800E6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.google-analytics.com;reprt-uri
Source: chrome.exe, 00000011.00000002.2696504993.000051D8009BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.gstatic.com/generate_204
Source: chrome.exe, 00000011.00000002.2697276538.000051D800C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2609596103.000051D800C0C000.00000004.00000800.00020000.00000000.sdmp, 0ZC2DB.13.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000011.00000002.2693162053.000051D800098000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000011.00000002.2697452538.000051D800C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2694600572.000051D8004A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2694476137.000051D800424000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000011.00000002.2697452538.000051D800C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2692880330.000051D80000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000011.00000002.2693776369.000051D8001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000011.00000002.2693776369.000051D8001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000011.00000002.2693776369.000051D8001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000011.00000002.2693776369.000051D8001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000011.00000002.2697452538.000051D800C84000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Q
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000011.00000002.2694450601.000051D800418000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000011.00000003.2630638238.000051D800294000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000011.00000003.2630638238.000051D800294000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000011.00000002.2693204542.000051D8000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000011.00000002.2693204542.000051D8000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000011.00000002.2693204542.000051D8000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000011.00000002.2693162053.000051D800098000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000011.00000002.2693776369.000051D8001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000011.00000003.2641786183.000051D8022BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644390867.000051D8022C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644448605.000051D8022CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000011.00000003.2607988142.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2607463400.000051D80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608029609.000051D800A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000011.00000003.2655020242.000051D802AB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2654594591.000051D802B34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://apis.google.com
Source: msedge.exe, 00000015.00000002.2760766882.000002708D6DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://arc.msn.com
Source: msedge.exe, 00000019.00000002.2927532274.0000022CE567B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://arc.msn.coml
Source: Inf.com, 0000000D.00000002.3268617637.000000000013D000.00000040.00001000.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shop
Source: Inf.com, 0000000D.00000002.3274095484.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3277051984.00000000044FD000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3276645001.0000000004460000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shop/
Source: Inf.com, 0000000D.00000002.3277051984.00000000044FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shop/-end-point:
Source: Inf.com, 0000000D.00000002.3274650017.00000000015CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shop/.
Source: Inf.com, 0000000D.00000002.3274650017.00000000015CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shop/:
Source: Inf.com, 0000000D.00000002.3274650017.00000000015CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shop/?
Source: Inf.com, 0000000D.00000002.3277051984.00000000044FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shop/Fx
Source: Inf.com, 0000000D.00000002.3274650017.00000000015CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shop/L
Source: Inf.com, 0000000D.00000002.3277051984.00000000044FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shop/bx
Source: Inf.com, 0000000D.00000002.3274095484.00000000014E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shop/e3f
Source: Inf.com, 0000000D.00000002.3277051984.00000000044FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shop/s
Source: Inf.com, 0000000D.00000002.3274650017.00000000015AA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shop/shpad
Source: Inf.com, 0000000D.00000002.3274095484.00000000014E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shop/t
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shop37Q9R1VS--tent-Disposition:
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shopHDBIMOZ
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shopUVWXYZ1234567890X
Source: Inf.com, 0000000D.00000002.3268617637.00000000001CD000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shopYUSJEU
Source: Inf.com, 0000000D.00000002.3268617637.00000000001CD000.00000040.00001000.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shopart/form-data;
Source: Inf.com, 0000000D.00000002.3268617637.00000000001CD000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shopata
Source: Inf.com, 0000000D.00000002.3268617637.00000000001CD000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shophhhv.default-release_cookies.dbta
Source: Inf.com, 0000000D.00000002.3268617637.000000000028F000.00000040.00001000.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://bijutr.shopsh;
Source: Inf.com, 0000000D.00000002.3279538912.0000000004741000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3277634519.0000000004605000.00000004.00000800.00020000.00000000.sdmp, LNOHDB.13.dr String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: Inf.com, 0000000D.00000002.3279538912.0000000004741000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3277634519.0000000004605000.00000004.00000800.00020000.00000000.sdmp, LNOHDB.13.dr String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: chrome.exe, 00000011.00000002.2695787632.000051D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698040666.000051D800D94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2694719675.000051D80050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695062193.000051D80060C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000011.00000002.2697276538.000051D800C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2609596103.000051D800C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000011.00000002.2697276538.000051D800C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2609596103.000051D800C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000011.00000002.2697276538.000051D800C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2609596103.000051D800C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: Inf.com, 0000000D.00000002.3277634519.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 0ZC2DB.13.dr, D2DTJM.13.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000011.00000002.2697098490.000051D800B88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000011.00000002.2697098490.000051D800B88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000011.00000002.2697098490.000051D800B88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: Inf.com, 0000000D.00000002.3277634519.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2694476137.000051D800424000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 0ZC2DB.13.dr, D2DTJM.13.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000011.00000003.2611828132.000051D800D40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2762439498.000054E000020000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.2937100541.000051040458C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: manifest.json.27.dr String found in binary or memory: https://chrome.google.com/webstore/
Source: chrome.exe, 00000011.00000002.2695062193.000051D80060C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000011.00000002.2696504993.000051D8009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695136498.000051D800644000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2693776369.000051D8001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698496579.000051D800E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2699355988.000051D8011D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2696287556.000051D800944000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000011.00000003.2608726803.000051D800D40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2609816701.000051D800CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2616350144.000051D800D40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2619759607.000051D800CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2608688940.000051D800CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2609837595.000051D800CCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2622194764.000051D800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2611828132.000051D800D40000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000011.00000002.2688100118.00001EAC00920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2599684596.00001EAC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2599807916.00001EAC00728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000011.00000002.2688100118.00001EAC00920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2599684596.00001EAC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2599807916.00001EAC00728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000011.00000002.2688100118.00001EAC00920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000011.00000003.2641786183.000051D8022BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644390867.000051D8022C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644448605.000051D8022CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2688100118.00001EAC00920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2599684596.00001EAC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2599807916.00001EAC00728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000011.00000002.2692880330.000051D80000C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2762439498.000054E000020000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.2937100541.000051040458C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.27.dr String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000011.00000002.2697276538.000051D800C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2609596103.000051D800C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000011.00000002.2693776369.000051D8001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000011.00000002.2693776369.000051D8001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/g
Source: chrome.exe, 00000011.00000003.2596264640.000006F8002EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2596226146.000006F8002E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000011.00000002.2695703721.000051D8007D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695136498.000051D800644000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2605228304.000051D800498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695281946.000051D8006B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2696287556.000051D800944000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2696138738.000051D8008E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2692880330.000051D80000C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2762439498.000054E000020000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.2935675519.0000510404440000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.27.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000011.00000002.2696423318.000051D800984000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000011.00000002.2696423318.000051D800984000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000011.00000002.2695787632.000051D80080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000011.00000002.2693776369.000051D8001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000011.00000002.2693776369.000051D8001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000011.00000002.2695161383.000051D800654000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: Inf.com, 0000000D.00000002.3279538912.0000000004741000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3277634519.0000000004605000.00000004.00000800.00020000.00000000.sdmp, LNOHDB.13.dr String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Inf.com, 0000000D.00000002.3279538912.0000000004741000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3277634519.0000000004605000.00000004.00000800.00020000.00000000.sdmp, LNOHDB.13.dr String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: chrome.exe, 00000011.00000002.2699759554.000051D80136C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: 2cc80dabc69f58b6_0.27.dr, Reporting and NEL.28.dr String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: chrome.exe, 00000011.00000002.2694171038.000051D80030C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.goog
Source: chrome.exe, 00000011.00000002.2694171038.000051D80030C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.googl0
Source: manifest.json0.27.dr String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000011.00000002.2697390661.000051D800C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698496579.000051D800E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/
Source: chrome.exe, 00000011.00000002.2699073368.000051D801120000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000011.00000002.2699073368.000051D801120000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2699271875.000051D801198000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697416968.000051D800C64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000011.00000002.2699073368.000051D801120000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000011.00000003.2644901617.000051D802338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644868444.000051D802334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644766927.000051D802330000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000011.00000002.2697390661.000051D800C54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/dogl
Source: chrome.exe, 00000011.00000002.2697740655.000051D800D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697067299.000051D800B74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2699073368.000051D801120000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698496579.000051D800E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697359505.000051D800C3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000011.00000002.2697359505.000051D800C3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default0
Source: chrome.exe, 00000011.00000002.2698496579.000051D800E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultlt
Source: chrome.exe, 00000011.00000002.2698496579.000051D800E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/njb
Source: chrome.exe, 00000011.00000002.2694632243.000051D8004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697416968.000051D800C64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695498959.000051D800740000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000011.00000002.2694632243.000051D8004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697416968.000051D800C64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695498959.000051D800740000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000011.00000002.2694632243.000051D8004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697416968.000051D800C64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695498959.000051D800740000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000011.00000002.2699355988.000051D8011D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2696868366.000051D800AB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 00000011.00000002.2699073368.000051D801120000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000011.00000002.2699073368.000051D801120000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2699271875.000051D801198000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697416968.000051D800C64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000011.00000002.2699073368.000051D801120000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000011.00000002.2699160374.000051D801148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2699073368.000051D801120000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697359505.000051D800C3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000011.00000002.2696868366.000051D800AB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/oglpH
Source: chrome.exe, 00000011.00000002.2695787632.000051D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698040666.000051D800D94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2694719675.000051D80050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695062193.000051D80060C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000011.00000002.2696287556.000051D800944000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/
Source: chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000011.00000002.2699271875.000051D801198000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697416968.000051D800C64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000011.00000002.2698496579.000051D800E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000011.00000002.2696287556.000051D800944000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/ogl
Source: chrome.exe, 00000011.00000002.2695787632.000051D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698040666.000051D800D94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2694719675.000051D80050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695062193.000051D80060C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000011.00000002.2698040666.000051D800D94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actionsUI
Source: manifest.json0.27.dr String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.27.dr String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.27.dr String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000011.00000002.2694171038.000051D80030C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp
Source: manifest.json0.27.dr String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000011.00000002.2694171038.000051D80030C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.googl
Source: manifest.json0.27.dr String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000011.00000002.2694171038.000051D80030C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.c
Source: manifest.json0.27.dr String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000011.00000002.2694171038.000051D80030C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.go
Source: manifest.json0.27.dr String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.27.dr String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.27.dr String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.27.dr String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000011.00000003.2618170710.000051D80100C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: manifest.json0.27.dr String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000011.00000002.2697416968.000051D800C64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000011.00000002.2699819467.000051D8013E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697416968.000051D800C64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2635630335.000051D8013E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2696868366.000051D800AB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000011.00000002.2696868366.000051D800AB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2L
Source: chrome.exe, 00000011.00000002.2699819467.000051D8013E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2635630335.000051D8013E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2ation.Result
Source: chrome.exe, 00000011.00000002.2699819467.000051D8013E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2635630335.000051D8013E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2d
Source: chrome.exe, 00000011.00000002.2697416968.000051D800C64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000011.00000002.2699271875.000051D801198000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697416968.000051D800C64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000011.00000003.2609596103.000051D800C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000011.00000002.2697276538.000051D800C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2609596103.000051D800C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: Inf.com, 0000000D.00000002.3277634519.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697276538.000051D800C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2609596103.000051D800C0C000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 0ZC2DB.13.dr, D2DTJM.13.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Inf.com, 0000000D.00000002.3277634519.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697276538.000051D800C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2609596103.000051D800C0C000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 0ZC2DB.13.dr, D2DTJM.13.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000011.00000002.2697276538.000051D800C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2609596103.000051D800C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: Inf.com, 0000000D.00000002.3277634519.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 0ZC2DB.13.dr, D2DTJM.13.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 0abb4798-9ad1-4876-a169-ff21bd97f0a9.tmp.27.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 0abb4798-9ad1-4876-a169-ff21bd97f0a9.tmp.27.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: 0abb4798-9ad1-4876-a169-ff21bd97f0a9.tmp.27.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 0abb4798-9ad1-4876-a169-ff21bd97f0a9.tmp.27.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 0abb4798-9ad1-4876-a169-ff21bd97f0a9.tmp.27.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: chrome.exe, 00000011.00000003.2644448605.000051D8022CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2688100118.00001EAC00920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000011.00000003.2641786183.000051D8022BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644390867.000051D8022C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644448605.000051D8022CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/%K
Source: chrome.exe, 00000011.00000003.2641786183.000051D8022BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644390867.000051D8022C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644448605.000051D8022CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com//H
Source: chrome.exe, 00000011.00000003.2641786183.000051D8022BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644390867.000051D8022C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644448605.000051D8022CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com//K
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2599684596.00001EAC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2599807916.00001EAC00728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000011.00000003.2641786183.000051D8022BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644390867.000051D8022C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644448605.000051D8022CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/3H
Source: chrome.exe, 00000011.00000003.2641786183.000051D8022BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644390867.000051D8022C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644448605.000051D8022CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/6K
Source: chrome.exe, 00000011.00000003.2641786183.000051D8022BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644390867.000051D8022C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644448605.000051D8022CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/9K
Source: chrome.exe, 00000011.00000003.2641786183.000051D8022BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644390867.000051D8022C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644448605.000051D8022CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/=H
Source: chrome.exe, 00000011.00000003.2641786183.000051D8022BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644390867.000051D8022C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644448605.000051D8022CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/?K
Source: chrome.exe, 00000011.00000003.2641786183.000051D8022BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644390867.000051D8022C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2644448605.000051D8022CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2688100118.00001EAC00920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2599684596.00001EAC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2599807916.00001EAC00728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000011.00000003.2646384817.000051D8024B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2646527464.000051D8024B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: msedge.exe, 00000019.00000002.2937556808.00005104046D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: chrome.exe, 00000011.00000002.2693776369.000051D8001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000011.00000002.2695062193.000051D80060C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: Inf.com, 0000000D.00000002.3277634519.0000000004605000.00000004.00000800.00020000.00000000.sdmp, LNOHDB.13.dr String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000019.00000003.2865793489.0000510404780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000015.00000003.2756846802.000054E000384000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000011.00000002.2694632243.000051D8004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697416968.000051D800C64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695498959.000051D800740000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000011.00000002.2694632243.000051D8004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697416968.000051D800C64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695498959.000051D800740000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000011.00000003.2599807916.00001EAC00728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000011.00000002.2686928527.00001EAC00238000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000011.00000003.2599684596.00001EAC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2599807916.00001EAC00728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000011.00000003.2642278208.000051D8027A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardQ
Source: chrome.exe, 00000011.00000003.2599684596.00001EAC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2599807916.00001EAC00728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000011.00000002.2688036889.00001EAC00904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000011.00000003.2599807916.00001EAC00728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000011.00000002.2694476137.000051D800424000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2655159315.000051D802B60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000011.00000003.2618312497.000051D80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618312497.000051D801264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618170710.000051D80100C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000011.00000003.2618312497.000051D80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618312497.000051D801264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618170710.000051D80100C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000011.00000003.2599684596.00001EAC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2599807916.00001EAC00728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000011.00000003.2600291805.00001EAC00878000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2688005030.00001EAC008D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000011.00000003.2599807916.00001EAC00728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000011.00000002.2688100118.00001EAC00920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000011.00000002.2688100118.00001EAC00920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918=
Source: chrome.exe, 00000011.00000002.2688005030.00001EAC008D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000011.00000003.2641786183.000051D8022BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000011.00000002.2693776369.000051D8001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2602522382.000051D8001C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000011.00000003.2602522382.000051D8001C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://m.google.com/devicemanagement/data/apiQ
Source: chrome.exe, 00000011.00000002.2697486285.000051D800CA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/
Source: chrome.exe, 00000011.00000002.2699073368.000051D801120000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000011.00000002.2694476137.000051D800424000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2655159315.000051D802B60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?tab=rm&amp;ogbl
Source: chrome.exe, 00000011.00000002.2699073368.000051D801120000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2699271875.000051D801198000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697416968.000051D800C64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000011.00000002.2699073368.000051D801120000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000011.00000002.2699073368.000051D801120000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2699271875.000051D801198000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000011.00000002.2697486285.000051D800CA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/o
Source: msedge.exe, 00000019.00000002.2937556808.00005104046D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000019.00000002.2937556808.00005104046D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://msn.com/
Source: Cookies.28.dr String found in binary or memory: https://msn.comXID/
Source: Cookies.28.dr String found in binary or memory: https://msn.comXIDv10
Source: chrome.exe, 00000011.00000002.2695787632.000051D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698040666.000051D800D94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2694719675.000051D80050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695062193.000051D80060C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000011.00000002.2695062193.000051D80060C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGAQ
Source: chrome.exe, 00000011.00000002.2695136498.000051D800644000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2696111849.000051D8008D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2694476137.000051D800424000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000011.00000002.2695336464.000051D8006D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2696111849.000051D8008D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698496579.000051D800E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2694476137.000051D800424000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000011.00000002.2698496579.000051D800E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneQ
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000011.00000002.2694476137.000051D800424000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000011.00000002.2693279241.000051D8000EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2610623348.000051D800F88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myactivity.google.com/
Source: 2cc80dabc69f58b6_0.27.dr, 000003.log5.27.dr String found in binary or memory: https://ntp.msn.com
Source: QuotaManager.27.dr String found in binary or memory: https://ntp.msn.com/_default
Source: QuotaManager.27.dr, QuotaManager-journal.27.dr String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: QuotaManager.27.dr, QuotaManager-journal.27.dr String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default/
Source: 2cc80dabc69f58b6_0.27.dr String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chrome.exe, 00000011.00000002.2693776369.000051D8001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 00000019.00000002.2937556808.00005104046D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://office.net/
Source: chrome.exe, 00000011.00000003.2655020242.000051D802AB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2654594591.000051D802B34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000011.00000003.2656420155.000051D800294000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000011.00000003.2655020242.000051D802AB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2654594591.000051D802B34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000011.00000003.2655020242.000051D802AB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2654594591.000051D802B34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000011.00000003.2610074266.000051D8009A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698732265.000051D800F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698121828.000051D800DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698178015.000051D800DF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698703866.000051D800F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2699454105.000051D801300000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000011.00000002.2698496579.000051D800E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000011.00000003.2610074266.000051D8009A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698732265.000051D800F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698178015.000051D800DF0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000011.00000002.2698178015.000051D800DF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698703866.000051D800F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2699454105.000051D801300000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000011.00000003.2610074266.000051D8009A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698732265.000051D800F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698178015.000051D800DF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2699454105.000051D801300000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000011.00000003.2610074266.000051D8009A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698178015.000051D800DF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698703866.000051D800F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2694062853.000051D8002E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2699454105.000051D801300000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000011.00000003.2610074266.000051D8009A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698732265.000051D800F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698121828.000051D800DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698178015.000051D800DF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698703866.000051D800F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2699454105.000051D801300000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000011.00000002.2698496579.000051D800E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697153102.000051D800B9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000011.00000002.2694632243.000051D8004D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: msedge.exe, 00000015.00000003.2752966667.000054E000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756110960.000054E000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2858539444.000051040467C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000015.00000003.2752966667.000054E000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756110960.000054E000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2858539444.000051040467C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000019.00000003.2858539444.000051040467C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/LogoutYxAB
Source: msedge.exe, 00000015.00000003.2752966667.000054E000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756110960.000054E000284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000015.00000003.2752966667.000054E000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756110960.000054E000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2858539444.000051040467C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000015.00000003.2752966667.000054E000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756110960.000054E000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2858539444.000051040467C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000015.00000003.2752966667.000054E000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756110960.000054E000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2858539444.000051040467C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000015.00000003.2752966667.000054E000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756110960.000054E000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2858539444.000051040467C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000015.00000003.2752966667.000054E000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756110960.000054E000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2858539444.000051040467C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000015.00000003.2752966667.000054E000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756110960.000054E000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2858539444.000051040467C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000015.00000003.2752966667.000054E000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756110960.000054E000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2858539444.000051040467C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000015.00000003.2752966667.000054E000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756110960.000054E000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2858539444.000051040467C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000015.00000003.2752966667.000054E000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756110960.000054E000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2858539444.000051040467C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000015.00000003.2752966667.000054E000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756110960.000054E000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2858539444.000051040467C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000015.00000003.2752966667.000054E000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2756110960.000054E000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2858539444.000051040467C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000011.00000002.2696726646.000051D800A4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2693279241.000051D8000EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2610623348.000051D800F88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000011.00000003.2618312497.000051D80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618312497.000051D801264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2618170710.000051D80100C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000011.00000002.2693279241.000051D8000EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2610623348.000051D800F88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000011.00000002.2693162053.000051D800098000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000011.00000002.2693204542.000051D8000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000011.00000002.2693776369.000051D8001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000011.00000002.2694632243.000051D8004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697416968.000051D800C64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695498959.000051D800740000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000011.00000002.2694632243.000051D8004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697416968.000051D800C64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695498959.000051D800740000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000011.00000002.2694450601.000051D800418000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000011.00000002.2694476137.000051D800424000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2655159315.000051D802B60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: Inf.com, 0000000D.00000003.2418360409.0000000004761000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000003.2418518687.0000000001529000.00000004.00000020.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3268617637.00000000000F1000.00000040.00001000.00020000.00000000.sdmp, Inf.com, 0000000D.00000003.2418604420.00000000044E8000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3274095484.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, Inf.com, 0000000D.00000003.2418255884.0000000004469000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000003.2418297625.0000000001505000.00000004.00000020.00020000.00000000.sdmp, Inf.com, 0000000D.00000003.2418561056.00000000015AB000.00000004.00000020.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3276645001.0000000004460000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512
Source: Inf.com, 0000000D.00000002.3276645001.0000000004460000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512m0nk3Mozilla/5.0
Source: Inf.com, 0000000D.00000002.3282318850.00000000065FB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Inf.com, 0000000D.00000002.3282318850.00000000065FB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Inf.com, 0000000D.00000003.2418174745.0000000004478000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000003.2418255884.0000000004469000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000003.2418149461.00000000044FF000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000003.2418413871.00000000044E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t.m
Source: Inf.com, 0000000D.00000002.3276645001.0000000004460000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t.me/
Source: Inf.com, 0000000D.00000003.2418174745.0000000004478000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000003.2418255884.0000000004469000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000003.2418149461.00000000044FF000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000003.2418413871.00000000044E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t.me/k04
Source: Inf.com, 0000000D.00000002.3277051984.00000000044EA000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3268617637.00000000000F1000.00000040.00001000.00020000.00000000.sdmp, Inf.com, 0000000D.00000003.2418604420.00000000044E8000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3274095484.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, Inf.com, 0000000D.00000003.2418255884.0000000004469000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3268617637.000000000013D000.00000040.00001000.00020000.00000000.sdmp, Inf.com, 0000000D.00000003.2418297625.0000000001505000.00000004.00000020.00020000.00000000.sdmp, Inf.com, 0000000D.00000003.2418561056.00000000015AB000.00000004.00000020.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3276645001.0000000004460000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t.me/k04ael
Source: Inf.com, 0000000D.00000002.3277051984.00000000044EA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t.me/k04ael$
Source: Inf.com, 0000000D.00000002.3276645001.0000000004460000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t.me/k04aelm0nk3Mozilla/5.0
Source: chrome.exe, 00000011.00000002.2696504993.000051D8009BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000011.00000002.2693776369.000051D8001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tasks.googleapis.com/
Source: Inf.com, 0000000D.00000002.3277051984.00000000044EA000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3268617637.000000000013D000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://web.telegram.org
Source: Inf.com, 0000000D.00000002.3279538912.0000000004741000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3277634519.0000000004605000.00000004.00000800.00020000.00000000.sdmp, LNOHDB.13.dr String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: Subtle.9.dr, Inf.com.2.dr String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Inf.com, 0000000D.00000002.3279538912.0000000004741000.00000004.00000800.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3277634519.0000000004605000.00000004.00000800.00020000.00000000.sdmp, LNOHDB.13.dr String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp, 0ZC2DB.13.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000011.00000002.2697276538.000051D800C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2609596103.000051D800C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000011.00000002.2697276538.000051D800C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2609596103.000051D800C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000011.00000002.2697276538.000051D800C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2609596103.000051D800C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: Inf.com.2.dr String found in binary or memory: https://www.globalsign.com/repository/0
Source: chrome.exe, 00000011.00000003.2630638238.000051D800294000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000011.00000002.2694450601.000051D800418000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000011.00000002.2694450601.000051D800418000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000011.00000003.2611828132.000051D800D40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695161383.000051D800654000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000011.00000002.2696611983.000051D800A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/CharPk3
Source: chrome.exe, 00000011.00000002.2697217064.000051D800BD8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/CharQ
Source: chrome.exe, 00000011.00000002.2697452538.000051D800C84000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000011.00000002.2698418581.000051D800E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/newtab_promos
Source: content.js.27.dr, content_new.js.27.dr String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000011.00000002.2698312359.000051D800E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2693776369.000051D8001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2696190907.000051D8008F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695498959.000051D800740000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000011.00000002.2698312359.000051D800E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2693776369.000051D8001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2696190907.000051D8008F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695498959.000051D800740000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: Inf.com, 0000000D.00000002.3277634519.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697067299.000051D800B74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2694719675.000051D80050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695062193.000051D80060C000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 0ZC2DB.13.dr, D2DTJM.13.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000011.00000002.2697067299.000051D800B74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoQ
Source: chrome.exe, 00000011.00000002.2694476137.000051D800424000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2655159315.000051D802B60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/imghp?hl=en&amp;tab=ri&amp;ogbl
Source: chrome.exe, 00000011.00000003.2655020242.000051D802AB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2654594591.000051D802B34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000011.00000003.2618170710.000051D80100C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000011.00000002.2694632243.000051D8004D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000011.00000002.2696504993.000051D8009BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000011.00000003.2630638238.000051D800294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2694450601.000051D800418000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000011.00000002.2692880330.000051D80000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000011.00000003.2646589128.000051D8024B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000011.00000003.2641786183.000051D80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000011.00000002.2693836696.000051D80020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000011.00000003.2659699616.000051D800E68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698393314.000051D800E6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2633307189.000051D800E68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2655794275.000051D800E6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.
Source: chrome.exe, 00000011.00000002.2694450601.000051D800418000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000011.00000003.2659699616.000051D800E68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698393314.000051D800E6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2633307189.000051D800E68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2655794275.000051D800E6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.om
Source: chrome.exe, 00000011.00000002.2694450601.000051D800418000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000011.00000002.2694632243.000051D8004D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000011.00000002.2702850314.000051D802AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000011.00000003.2654763634.000051D802B24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2655078399.000051D802A7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2655120352.000051D802A98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2654502382.000051D802A7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2655159315.000051D802B60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2654990783.000051D802AC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2702850314.000051D802AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000011.00000003.2655020242.000051D802AB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2654594591.000051D802B34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.otmEBJ358uU.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000011.00000003.2655020242.000051D802AB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2654594591.000051D802B34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd
Source: Inf.com, 0000000D.00000002.3282318850.00000000065FB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: Inf.com, 0000000D.00000002.3282318850.00000000065FB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: Inf.com, 0000000D.00000002.3282318850.00000000065FB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Inf.com, 0000000D.00000002.3282318850.00000000065FB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Inf.com, 0000000D.00000002.3282318850.00000000065FB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: Inf.com, 0000000D.00000002.3282318850.00000000065FB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: chrome.exe, 00000011.00000002.2697486285.000051D800CA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697911899.000051D800D5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000011.00000002.2699819467.000051D8013E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697911899.000051D800D5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2635630335.000051D8013E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2696868366.000051D800AB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000011.00000002.2699819467.000051D8013E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2635630335.000051D8013E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytcaogl
Source: chrome.exe, 00000011.00000002.2696868366.000051D800AB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytcap
Source: chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697911899.000051D800D5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000011.00000002.2699160374.000051D801148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2698496579.000051D800E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2695591525.000051D80079B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2697911899.000051D800D5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: chrome.exe, 00000011.00000002.2699160374.000051D801148000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmlault
Source: chrome.exe, 00000011.00000002.2698496579.000051D800E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.245.216.205:443 -> 192.168.2.5:49756 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\lem.exe Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_004050F9
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A8F7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 13_2_00A8F7C7
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A8F55C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 13_2_00A8F55C
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\lem.exe Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_004044D1
Potential key logger detected (key state polling based)
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00AA9FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 13_2_00AA9FD2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 13.2.Inf.com.f0000.0.unpack, type: UNPACKEDPE Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A2FFE0 CloseHandle,NtProtectVirtualMemory, 13_2_00A2FFE0
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A84763: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle, 13_2_00A84763
Contains functionality to launch a process as a different user
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A71B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 13_2_00A71B4D
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\lem.exe Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx, 0_2_004038AF
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A7F20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 13_2_00A7F20D
Creates files inside the system directory
Source: C:\Users\user\Desktop\lem.exe File created: C:\Windows\NortheastPresence Jump to behavior
Source: C:\Users\user\Desktop\lem.exe File created: C:\Windows\FascinatingFee Jump to behavior
Source: C:\Users\user\Desktop\lem.exe File created: C:\Windows\FinishedMistress Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\lem.exe Code function: 0_2_0040737E 0_2_0040737E
Source: C:\Users\user\Desktop\lem.exe Code function: 0_2_00406EFE 0_2_00406EFE
Source: C:\Users\user\Desktop\lem.exe Code function: 0_2_004079A2 0_2_004079A2
Source: C:\Users\user\Desktop\lem.exe Code function: 0_2_004049A8 0_2_004049A8
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A38017 13_2_00A38017
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A1E1F0 13_2_00A1E1F0
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A2E144 13_2_00A2E144
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A322A2 13_2_00A322A2
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A122AD 13_2_00A122AD
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A4A26E 13_2_00A4A26E
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A2C624 13_2_00A2C624
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A9C8A4 13_2_00A9C8A4
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A4E87F 13_2_00A4E87F
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A46ADE 13_2_00A46ADE
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A82A05 13_2_00A82A05
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A78BFF 13_2_00A78BFF
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A2CD7A 13_2_00A2CD7A
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A3CE10 13_2_00A3CE10
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A47159 13_2_00A47159
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A19240 13_2_00A19240
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00AA5311 13_2_00AA5311
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A196E0 13_2_00A196E0
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A31704 13_2_00A31704
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A31A76 13_2_00A31A76
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A37B8B 13_2_00A37B8B
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A19B60 13_2_00A19B60
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A37DBA 13_2_00A37DBA
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A31D20 13_2_00A31D20
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A31FE7 13_2_00A31FE7
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\lem.exe Code function: String function: 004062CF appears 58 times
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: String function: 00A30DA0 appears 46 times
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: String function: 00A2FD52 appears 40 times
PE / OLE file has an invalid certificate
Source: lem.exe Static PE information: invalid certificate
Uses 32bit PE files
Source: lem.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 13.2.Inf.com.f0000.0.unpack, type: UNPACKEDPE Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 68QI5X.13.dr Binary string: #WriteOfflineHivesTerminateSetupModuleds\security\cryptoapi\cryptosetup\cryptosetup.cDCryptoSetup module terminatedCryptoSetupNewRegistryCallBackCryptoSetup EntropyWrite given invalid event typeCryptoSetup EntropyWrite given invalid event data sizeWriteEntropyToNewRegistryCryptoSetup failed to get Ksecdd entropy %08xRNGCryptoSetup failed to open system hive key %08xExternalEntropyCryptoSetup failed to write entropy into the system hive %08xCryptoSetup failed to close system hive key %08xCryptoSetup succeeded writing entropy key\Device\KsecDDWriteCapiMachineGuidCryptoSetup failed get entropy from ksecdd for CAPI machine guid %08x%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02xCryptoSetup failed to convert CAPI machine guid to string %08xMicrosoft\CryptographyCryptoSetup failed get open/create reg key for CAPI machine guid %08xMachineGuidCryptoSetup failed get write CAPI machine guid %08xCryptoSetup assigned CAPI machine guid "%s"
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@97/306@31/16
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A841FA GetLastError,FormatMessageW, 13_2_00A841FA
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A72010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 13_2_00A72010
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A71A0B AdjustTokenPrivileges,CloseHandle, 13_2_00A71A0B
Source: C:\Users\user\Desktop\lem.exe Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_004044D1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A7DD87 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle, 13_2_00A7DD87
Source: C:\Users\user\Desktop\lem.exe Code function: 0_2_004024FB CoCreateInstance, 0_2_004024FB
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A83A0E CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource, 13_2_00A83A0E
Source: C:\Users\user\Desktop\lem.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Authorization Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5044:120:WilError_03
Source: C:\Users\user\Desktop\lem.exe File created: C:\Users\user\AppData\Local\Temp\nst7743.tmp Jump to behavior
Source: lem.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\Desktop\lem.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: chrome.exe, 00000011.00000002.2695591525.000051D800798000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: AAS00R1VA.13.dr, L68GDJMO8.13.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: lem.exe Virustotal: Detection: 11%
Source: C:\Users\user\Desktop\lem.exe File read: C:\Users\user\Desktop\lem.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\lem.exe "C:\Users\user\Desktop\lem.exe"
Source: C:\Users\user\Desktop\lem.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Cohen Cohen.cmd & Cohen.cmd
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 105235
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Authorization
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "aid" Division
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 105235\Inf.com + Proceedings + Recovery + Webster + Sunglasses + Cultural + Tulsa + Being + Name + Silicon + Subtle 105235\Inf.com
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Glad + ..\Norway + ..\Tired m
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Inf.com m
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2028,i,9558792887393012280,750728347199566244,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: unknown Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2612 --field-trial-handle=2348,i,16825700261060781497,4542343586263828096,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=2176,i,2777762876112308581,5901726477067019011,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2240,i,2906549977917240690,4367615623914022411,262144 /prefetch:3
Source: unknown Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2712 --field-trial-handle=2060,i,14832726659220639319,15004064942317753371,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6504 --field-trial-handle=2060,i,14832726659220639319,15004064942317753371,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6820 --field-trial-handle=2060,i,14832726659220639319,15004064942317753371,262144 /prefetch:8
Source: C:\Users\user\Desktop\lem.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Cohen Cohen.cmd & Cohen.cmd Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 105235 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Authorization Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "aid" Division Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 105235\Inf.com + Proceedings + Recovery + Webster + Sunglasses + Cultural + Tulsa + Being + Name + Silicon + Subtle 105235\Inf.com Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Glad + ..\Norway + ..\Tired m Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Inf.com m Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5 Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2028,i,9558792887393012280,750728347199566244,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2612 --field-trial-handle=2348,i,16825700261060781497,4542343586263828096,262144 /prefetch:3 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=2176,i,2777762876112308581,5901726477067019011,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2240,i,2906549977917240690,4367615623914022411,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2712 --field-trial-handle=2060,i,14832726659220639319,15004064942317753371,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6504 --field-trial-handle=2060,i,14832726659220639319,15004064942317753371,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6820 --field-trial-handle=2060,i,14832726659220639319,15004064942317753371,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\lem.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: Google Drive.lnk.17.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.17.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.17.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.17.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.17.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.17.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: lem.exe Static file information: File size 1273852 > 1048576
Source: lem.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: cryptosetup.pdbGCTL source: Inf.com, 0000000D.00000002.3274650017.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, 68QI5X.13.dr
Source: Binary string: cryptosetup.pdb source: Inf.com, 0000000D.00000002.3274650017.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, 68QI5X.13.dr
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\lem.exe Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_00406328
PE file contains an invalid checksum
Source: lem.exe Static PE information: real checksum: 0x13b848 should be: 0x144e84
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A30DE6 push ecx; ret 13_2_00A30DF9

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Jump to dropped file
Drops PE files
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Jump to dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File created: C:\ProgramData\9HDT0HDBIMOZ\68QI5X Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File created: C:\ProgramData\9HDT0HDBIMOZ\68QI5X Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File created: C:\ProgramData\9HDT0HDBIMOZ\68QI5X Jump to dropped file

Boot Survival
barindex
Monitors registry run keys for changes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00AA26DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 13_2_00AA26DD
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A2FC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 13_2_00A2FC7C
Source: C:\Users\user\Desktop\lem.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lem.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found API chain indicative of sandbox detection
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Inf.com, 0000000D.00000002.3276645001.0000000004460000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: %HSWPESPY.DLLAVGHOOKX.DLLSBIEDLL.DLLSNXHK.DLLVMCHECK.DLLDIR_WATCH.DLLAPI_LOG.DLLPSTOREC.DLLAVGHOOKA.DLLCMDVRT64.DLLCMDVRT32.DLLIMAGE/JPEGCHAININGMODEAESCHAININGMODEGCMABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=UNKNOWN EXCEPTIONBAD ALLOCATION
Source: Inf.com, 0000000D.00000002.3276645001.0000000004460000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: DIR_WATCH.DLLAP
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Dropped PE file which has not been started: C:\ProgramData\9HDT0HDBIMOZ\68QI5X Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com API coverage: 3.7 %
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\lem.exe Code function: 0_2_00406301 FindFirstFileW,FindClose, 0_2_00406301
Source: C:\Users\user\Desktop\lem.exe Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00406CC7
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A7DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 13_2_00A7DC54
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A8A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 13_2_00A8A087
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A8A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 13_2_00A8A1E2
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A7E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, 13_2_00A7E472
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A8A570 FindFirstFileW,Sleep,FindNextFileW,FindClose, 13_2_00A8A570
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A866DC FindFirstFileW,FindNextFileW,FindClose, 13_2_00A866DC
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A4C622 FindFirstFileExW, 13_2_00A4C622
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A873D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, 13_2_00A873D4
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A87333 FindFirstFileW,FindClose, 13_2_00A87333
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A7D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 13_2_00A7D921
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A15FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 13_2_00A15FC8
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Microsoft\Windows\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Microsoft\ Jump to behavior
Source: chrome.exe, 00000011.00000002.2693095928.000051D800080000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware
Source: D2DTJM.13.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: chrome.exe, 00000011.00000002.2683469881.00000161C7865000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: D2DTJM.13.dr Binary or memory string: discord.comVMware20,11696428655f
Source: D2DTJM.13.dr Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: D2DTJM.13.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: D2DTJM.13.dr Binary or memory string: global block list test formVMware20,11696428655
Source: D2DTJM.13.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Inf.com, 0000000D.00000002.3274095484.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, Inf.com, 0000000D.00000002.3277051984.00000000044FD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: msedge.exe, 00000015.00000003.2749568805.000054E00039C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware20,1(
Source: D2DTJM.13.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: D2DTJM.13.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: D2DTJM.13.dr Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: D2DTJM.13.dr Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: D2DTJM.13.dr Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: D2DTJM.13.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: D2DTJM.13.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: D2DTJM.13.dr Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: D2DTJM.13.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: chrome.exe, 00000011.00000002.2682443030.00000161C3CA8000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2760397293.000002708D643000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.2927420587.0000022CE5642000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: D2DTJM.13.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: D2DTJM.13.dr Binary or memory string: outlook.office.comVMware20,11696428655s
Source: D2DTJM.13.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: D2DTJM.13.dr Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: chrome.exe, 00000011.00000002.2683469881.00000161C7865000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: War&Prod_VMware_
Source: D2DTJM.13.dr Binary or memory string: AMC password management pageVMware20,11696428655
Source: D2DTJM.13.dr Binary or memory string: tasks.office.comVMware20,11696428655o
Source: chrome.exe, 00000011.00000002.2695703721.000051D8007D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=adebf139-8470-4e39-9765-e2a30b13ddca
Source: D2DTJM.13.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: D2DTJM.13.dr Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: D2DTJM.13.dr Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: chrome.exe, 00000011.00000002.2699271875.000051D801198000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware Virtual USB Mouse)
Source: D2DTJM.13.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: D2DTJM.13.dr Binary or memory string: dev.azure.comVMware20,11696428655j
Source: D2DTJM.13.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: D2DTJM.13.dr Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: D2DTJM.13.dr Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: D2DTJM.13.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Inf.com, 0000000D.00000002.3277051984.00000000044FD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWC&
Source: D2DTJM.13.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Process information queried: ProcessInformation Jump to behavior
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A8F4FF BlockInput, 13_2_00A8F4FF
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A1338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 13_2_00A1338B
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\lem.exe Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_00406328
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A35058 mov eax, dword ptr fs:[00000030h] 13_2_00A35058
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A720AA GetLengthSid,GetProcessHeap,HeapAlloc,CopySid,GetProcessHeap,HeapFree, 13_2_00A720AA
Enables debug privileges
Source: C:\Windows\SysWOW64\tasklist.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A42992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 13_2_00A42992
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A30BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 13_2_00A30BAF
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A30D45 SetUnhandledExceptionFilter, 13_2_00A30D45
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A30F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 13_2_00A30F91

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: Inf.com PID: 1276, type: MEMORYSTR
Contains functionality to execute programs as a different user
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A71B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 13_2_00A71B4D
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A1338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 13_2_00A1338B
Contains functionality to simulate keystroke presses
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A7BBED SendInput,keybd_event, 13_2_00A7BBED
Contains functionality to simulate mouse events
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A7EC9E mouse_event, 13_2_00A7EC9E
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\lem.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Cohen Cohen.cmd & Cohen.cmd Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 105235 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Authorization Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "aid" Division Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 105235\Inf.com + Proceedings + Recovery + Webster + Sunglasses + Cultural + Tulsa + Being + Name + Silicon + Subtle 105235\Inf.com Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Glad + ..\Norway + ..\Tired m Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Inf.com m Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5 Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A714AE GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 13_2_00A714AE
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A71FB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 13_2_00A71FB0
Source: Inf.com, 0000000D.00000002.3271313015.0000000000AD3000.00000002.00000001.01000000.00000007.sdmp, Inf.com.2.dr, Name.9.dr Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Inf.com Binary or memory string: Shell_TrayWnd
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A30A08 cpuid 13_2_00A30A08
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A6E5F4 GetLocalTime, 13_2_00A6E5F4
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A6E652 GetUserNameW, 13_2_00A6E652
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A4BCD2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free, 13_2_00A4BCD2
Source: C:\Users\user\Desktop\lem.exe Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW, 0_2_00406831

Stealing of Sensitive Information
barindex
Yara detected Vidar stealer
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 13.2.Inf.com.f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000003.2418518687.0000000001529000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2418360409.0000000004761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.3268617637.00000000000F1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2418604420.00000000044E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2418255884.0000000004469000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.3274095484.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2418297625.0000000001505000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2418561056.00000000015AB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.3276645001.0000000004460000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Inf.com PID: 1276, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: Inf.com, 0000000D.00000002.3268617637.00000000001CD000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: *wallet*.*,*seed*.*,*btc*.*,*key*.*,*2fa*.*,*crypto*.*,*coin*.*,*private*.*,*2fa*.*,*auth*.*,*ledger*.*,*trezor*.*,*pass*.*,*wal*.*,*upbit*.*,*bcex*.*,*bithimb*.*,*hitbtc*.*,*bitflyer*.*,*kucoin*.*,*huobi*.*,*poloniex*.*,*kraken*.*,*okex*.*,*binance*.*,*bitfinex*.*,*gdax*.*,*ethereum*.*,*exodus*.*,*metamask*.*,*myetherwallet*.*,*electrum*.*,*bitcoin*.*,*blockchain*.*,*coinomi*.*,*words*.*,*meta*.*,*mask*.*,*eth*.*,*recovery*.*
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Inf.com, 0000000D.00000002.3268617637.00000000001CD000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: *wallet*.*,*seed*.*,*btc*.*,*key*.*,*2fa*.*,*crypto*.*,*coin*.*,*private*.*,*2fa*.*,*auth*.*,*ledger*.*,*trezor*.*,*pass*.*,*wal*.*,*upbit*.*,*bcex*.*,*bithimb*.*,*hitbtc*.*,*bitflyer*.*,*kucoin*.*,*huobi*.*,*poloniex*.*,*kraken*.*,*okex*.*,*binance*.*,*bitfinex*.*,*gdax*.*,*ethereum*.*,*exodus*.*,*metamask*.*,*myetherwallet*.*,*electrum*.*,*bitcoin*.*,*blockchain*.*,*coinomi*.*,*words*.*,*meta*.*,*mask*.*,*eth*.*,*recovery*.*
Source: Inf.com, 0000000D.00000002.3268617637.00000000001CD000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: *wallet*.*,*seed*.*,*btc*.*,*key*.*,*2fa*.*,*crypto*.*,*coin*.*,*private*.*,*2fa*.*,*auth*.*,*ledger*.*,*trezor*.*,*pass*.*,*wal*.*,*upbit*.*,*bcex*.*,*bithimb*.*,*hitbtc*.*,*bitflyer*.*,*kucoin*.*,*huobi*.*,*poloniex*.*,*kraken*.*,*okex*.*,*binance*.*,*bitfinex*.*,*gdax*.*,*ethereum*.*,*exodus*.*,*metamask*.*,*myetherwallet*.*,*electrum*.*,*bitcoin*.*,*blockchain*.*,*coinomi*.*,*words*.*,*meta*.*,*mask*.*,*eth*.*,*recovery*.*
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Inf.com, 0000000D.00000002.3268617637.000000000029C000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\default\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Exodus\backups\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
OS version to string mapping found (often used in BOTs)
Source: Inf.com Binary or memory string: WIN_81
Source: Inf.com Binary or memory string: WIN_XP
Source: Name.9.dr Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: Inf.com Binary or memory string: WIN_XPe
Source: Inf.com Binary or memory string: WIN_VISTA
Source: Inf.com Binary or memory string: WIN_7
Source: Inf.com Binary or memory string: WIN_8
Yara detected Credential Stealer
Source: Yara match File source: 0000000D.00000002.3268617637.00000000000F1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.3274095484.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Inf.com PID: 1276, type: MEMORYSTR

Remote Access Functionality
barindex
Attempt to bypass Chrome Application-Bound Encryption
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Yara detected Vidar stealer
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 13.2.Inf.com.f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000003.2418518687.0000000001529000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2418360409.0000000004761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.3268617637.00000000000F1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2418604420.00000000044E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2418255884.0000000004469000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.3274095484.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2418297625.0000000001505000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2418561056.00000000015AB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.3276645001.0000000004460000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Inf.com PID: 1276, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A92263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 13_2_00A92263
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\105235\Inf.com Code function: 13_2_00A91C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket, 13_2_00A91C61
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1581175 Sample: lem.exe Startdate: 27/12/2024 Architecture: WINDOWS Score: 100 59 bijutr.shop 2->59 61 t.me 2->61 63 sAOREpcgcodbdSPJ.sAOREpcgcodbdSPJ 2->63 85 Suricata IDS alerts for network traffic 2->85 87 Found malware configuration 2->87 89 Malicious sample detected (through community Yara rule) 2->89 91 7 other signatures 2->91 10 lem.exe 18 2->10         started        12 msedge.exe 2->12         started        14 msedge.exe 2->14         started        signatures3 process4 process5 16 cmd.exe 2 10->16         started        20 msedge.exe 12->20         started        23 msedge.exe 12->23         started        25 msedge.exe 12->25         started        27 msedge.exe 14->27         started        dnsIp6 55 C:\Users\user\AppData\Local\...\Inf.com, PE32 16->55 dropped 83 Drops PE files with a suspicious file extension 16->83 29 Inf.com 32 16->29         started        34 cmd.exe 1 16->34         started        36 cmd.exe 2 16->36         started        38 9 other processes 16->38 65 18.164.116.98, 443, 49995 MIT-GATEWAYSUS United States 20->65 67 sb.scorecardresearch.com 18.165.220.57, 443, 49937 MIT-GATEWAYSUS United States 20->67 69 18 other IPs or domains 20->69 file7 signatures8 process9 dnsIp10 73 bijutr.shop 188.245.216.205, 443, 49756, 49762 PARSONLINETehran-IRANIR Iran (ISLAMIC Republic Of) 29->73 75 t.me 149.154.167.99, 443, 49750 TELEGRAMRU United Kingdom 29->75 77 127.0.0.1 unknown unknown 29->77 57 C:\ProgramData\9HDT0HDBIMOZ\68QI5X, PE32+ 29->57 dropped 95 Attempt to bypass Chrome Application-Bound Encryption 29->95 97 Found many strings related to Crypto-Wallets (likely being stolen) 29->97 99 Found API chain indicative of sandbox detection 29->99 101 4 other signatures 29->101 40 msedge.exe 2 10 29->40         started        43 msedge.exe 29->43         started        45 chrome.exe 8 29->45         started        file11 signatures12 process13 dnsIp14 93 Monitors registry run keys for changes 40->93 48 msedge.exe 40->48         started        50 msedge.exe 43->50         started        79 192.168.2.5, 443, 49209, 49703 unknown unknown 45->79 81 239.255.255.250 unknown Reserved 45->81 52 chrome.exe 45->52         started        signatures15 process16 dnsIp17 71 www.google.com 142.250.181.68, 443, 49802, 49804 GOOGLEUS United States 52->71
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
23.44.201.19
 unknown United States
20940 AKAMAI-ASN1EU false
149.154.167.99
 t.me United Kingdom
62041 TELEGRAMRU false
162.159.61.3
 chrome.cloudflare-dns.com United States
13335 CLOUDFLARENETUS false
142.250.181.68
 www.google.com United States
15169 GOOGLEUS false
13.89.178.27
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
20.110.205.119
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
188.245.216.205
 bijutr.shop Iran (ISLAMIC Republic Of)
16322 PARSONLINETehran-IRANIR true
204.79.197.219
 unknown United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
142.250.181.65
 googlehosted.l.googleusercontent.com United States
15169 GOOGLEUS false
172.64.41.3
 unknown United States
13335 CLOUDFLARENETUS false
23.209.72.40
 unknown United States
20940 AKAMAI-ASN1EU false
18.165.220.57
 sb.scorecardresearch.com United States
3 MIT-GATEWAYSUS false
239.255.255.250
 unknown Reserved
unknown unknown false
18.164.116.98
 unknown United States
3 MIT-GATEWAYSUS false

Private

IP
192.168.2.5
127.0.0.1

Contacted Domains

Name IP Active
bijutr.shop 188.245.216.205 true
chrome.cloudflare-dns.com 162.159.61.3 true
t.me 149.154.167.99 true
ssl.bingadsedgeextension-prod-europe.azurewebsites.net 94.245.104.56 true
sb.scorecardresearch.com 18.165.220.57 true
www.google.com 142.250.181.68 true
s-part-0035.t-0009.t-msedge.net 13.107.246.63 true
googlehosted.l.googleusercontent.com 142.250.181.65 true
clients2.googleusercontent.com unknown unknown
bzib.nelreports.net unknown unknown
assets.msn.com unknown unknown
sAOREpcgcodbdSPJ.sAOREpcgcodbdSPJ unknown unknown
c.msn.com unknown unknown
ntp.msn.com unknown unknown
api.msn.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735279301810&w=0&anoncknm=app_anon&NoResponseBody=true false
    		high
    https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735279303519&w=0&anoncknm=app_anon&NoResponseBody=true false
      		high
      https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735279302807&w=0&anoncknm=app_anon&NoResponseBody=true false
        		high
        https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735279295838&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true false
          		high
          https://sb.scorecardresearch.com/b?rn=1735279295840&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3918B198F66063F3328CA4FAF7676296&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null false
            		high