Windows Analysis Report
NRKCZ1PSDM.exe

Overview

General Information

Sample name: NRKCZ1PSDM.exe
renamed because original name is a hash value
Original sample name: d7066683b5e399415d6b2e09d97394ce1aec288992a9e303cd457110a92f5a3a.exe
Analysis ID: 1600329
MD5: 94184473f052d0d324323d67285fad14
SHA1: 82fb39cd22a126f8d4876b5ad97cc73b66885cd5
SHA256: d7066683b5e399415d6b2e09d97394ce1aec288992a9e303cd457110a92f5a3a
Tags: exevidaruser-Lars
Infos:

Detection

PureLog Stealer, Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Yara detected PureLog Stealer
Yara detected Vidar stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Machine Learning detection for sample
Maps a DLL or memory area into another process
Monitors registry run keys for changes
Searches for specific processes (likely to inject)
Self deletion via cmd or bat file
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found evasive API chain (date check)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE file contains an invalid checksum
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Browser Started with Remote Debugging
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection

barindex
Source: 00000002.00000002.2637808939.0000000000400000.00000040.00000400.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199819539662", "Botnet": "go2dniz"}
Source: NRKCZ1PSDM.exe Virustotal: Detection: 48% Perma Link
Source: NRKCZ1PSDM.exe ReversingLabs: Detection: 55%
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Source: NRKCZ1PSDM.exe Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00405FE7 CryptUnprotectData,LocalAlloc,LocalFree, 2_2_00405FE7
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0040E7E9 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,GetLastError,GetProcessHeap,HeapFree, 2_2_0040E7E9
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00406062 BCryptCloseAlgorithmProvider,BCryptDestroyKey, 2_2_00406062
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0040627F LocalAlloc,BCryptDecrypt, 2_2_0040627F
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0040609C BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey, 2_2_0040609C
Source: NRKCZ1PSDM.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49793 version: TLS 1.0
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.209.106:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49868 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50074 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50125 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50132 version: TLS 1.2
Source: NRKCZ1PSDM.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: System.Windows.Forms.pdb source: WER546.tmp.dmp.6.dr
Source: Binary string: vdr1.pdb source: NRKCZ1PSDM.exe, NRKCZ1PSDM.exe, 00000002.00000002.2637808939.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb source: WER546.tmp.dmp.6.dr
Source: Binary string: System.ni.pdbRSDS source: WER546.tmp.dmp.6.dr
Source: Binary string: A{"id":1,"method":"Storage.getCookies"}|.tgz.gzSecurityHistoryWork Dir: In memorySOFTWARE\Microsoft\Cryptographyfirefox%08lX%04lX%lu_key.txtSoft\Steam\steam_tokens.txt\Discord\tokens.txtpasswords.txtinformation.txtlocalhostWebSocketClient" & exitGdipGetImageHeightSoftGdipGetImagePixelFormatN0ZWFt\Monero\wallet.keysAzure\.awsstatusWallets_CreateProcessGdipGetImageEncodershttpsSoftware\Martin Prikryl\WinSCP 2\SessionsPlugins/devtoolsprefs.jsLocal Extension SettingsSync Extension SettingsFilescookiesCookies\BraveWallet\Preferenceskey_datas%s\%s\%sPortNumberCurrentBuildNumberGdiplusStartup.zipGdipCreateHBITMAPFromBitmapOpera Crypto.zooUnknownGdiplusShutdown/json_logins.jsoninvalid string positionSoftware\Martin Prikryl\WinSCP 2\ConfigurationDisplayVersionSOFTWARE\Microsoft\Windows NT\CurrentVersionopentokenamcommunity.comTelegramSoftware\Valve\SteamGdipSaveImageToStreamGdipLoadImageFromStream\AppData\Roaming\FileZilla\recentservers.xml.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallapprove_aprilNetworkblock.arjprofiles.ini.lzhGdipGetImageWidthwallet_pathSteamPathscreenshot.jpgstring too longvector<T> too longProcessorNameStringloginusers.vdflibraryfolders.vdfconfig.vdfDialogConfig.vdfDialogConfigOverlay*.vdfGdipGetImageEncodersSizesteam.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\cmd.exeC:\Windows\system32\rundll32.exeBravetrueformhistory.sqlitecookies.sqliteplaces.sqliteLocal StatefalseAzure\.azureSOFTWARE\monero-project\monero-corechromefile_nameDisplayNameHostNameProductNameUserNameGdipSaveImageToFilemsal.cacheGdipDisposeImagemodeAzure\.IdentityServiceUseMasterPasswordhwidMachineGuidtask_idbuild_idCrash DetectedDisabled%dx%d%d/%d/%d %d:%d:%d.arcvdr1.pdb\Local Storage\leveldb_0.indexeddb.leveldb_formhistory.db_history.db_cookies.db_passwords.db_webdata.db_key4.db\key4.dbfile_dataLogin DataWeb DataoperaOperachrome-extension_[Processes][Software]\storage\default\\.aws\errors\\Telegram Desktop\\Steam\\config\\.azure\ Stable\\.IdentityService\\discord\/c timeout /t 10 & rd /s /q "C:\ProgramData\" & rd /s /q "C:\ProgramData\\..\.ZDISPLAYOpera GXEXCEPTION_INT_OVERFLOWEXCEPTION_FLT_OVERFLOWEXCEPTION_STACK_OVERFLOWEXCEPTION_FLT_UNDERFLOWPOSTEXCEPTION_BREAKPOINT\Local Storage\leveldb\CURRENTEXCEPTION_DATATYPE_MISALIGNMENTEXCEPTION_FLT_INEXACT_RESULTGETEXCEPTION_IN_PAGE_ERRORdQw4w9WgXcQEXCEPTION_SINGLE_STEPGdipCreateBitmapFromHBITMAPEXCEPTION_INT_DIVIDE_BY_ZEROEXCEPTION_FLT_DIVIDE_BY_ZEROEXCEPTION_NONCONTINUABLE_EXCEPTIONUNKNOWN EXCEPTIONEXCEPTION_INVALID_DISPOSITIONEXCEPTION_PRIV_INSTRUCTIONEXCEPTION_ILLEGAL_INSTRUCTIONEXCEPTION_FLT_INVALID_OPERATIONEXCEPTION_ACCESS_VIOLATIONEXCEPTION_FLT_STACK_CHECKEXCEPTION_FLT_DENORMAL_OPERANDEXCEPTION_ARRAY_BOUNDS_EXCEEDED%d MBIndexedDBOCALAPPDATA?<Host><Port><User><Pass encoding="base64">http://localhost:"webSocketDebuggerUrl":6^userContextId=4294967295465 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73ws://localhost:9223.metadata-v2:22.ps15121Windows 11HTTP/1.1HARDWA
Source: Binary string: Excited.pdb! source: WER546.tmp.dmp.6.dr
Source: Binary string: mscorlib.ni.pdb source: WER546.tmp.dmp.6.dr
Source: Binary string: System.Core.pdb source: WER546.tmp.dmp.6.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WER546.tmp.dmp.6.dr
Source: Binary string: System.Windows.Forms.pdbt- source: WER546.tmp.dmp.6.dr
Source: Binary string: System.pdb< source: WER546.tmp.dmp.6.dr
Source: Binary string: Excited.pdb source: NRKCZ1PSDM.exe, WER546.tmp.dmp.6.dr
Source: Binary string: System.ni.pdb source: WER546.tmp.dmp.6.dr
Source: Binary string: System.pdb source: WER546.tmp.dmp.6.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WER546.tmp.dmp.6.dr
Source: Binary string: System.Core.ni.pdb source: WER546.tmp.dmp.6.dr
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00413C71 SHGetFolderPathA,wsprintfA,FindFirstFileA,FindNextFileA,strcpy,_splitpath,strcpy,strlen,isupper,wsprintfA,strcpy,strlen,SHFileOperationA,FindNextFileA,FindNextFileA,FindClose, 2_2_00413C71
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_004112E8 wsprintfA,FindFirstFileA,memset,memset,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,SymMatchString,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 2_2_004112E8
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00407891 FindFirstFileA,CopyFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,FindNextFileA,FindClose, 2_2_00407891
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0040A69C FindFirstFileA,StrCmpCA,CopyFileA,Sleep,DeleteFileA,FindNextFileA,FindClose, 2_2_0040A69C
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00408776 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 2_2_00408776
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00411D33 wsprintfA,FindFirstFileA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 2_2_00411D33
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_004013DA FindFirstFileA,FindNextFileA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindNextFileA,FindClose, 2_2_004013DA
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00406784 ExpandEnvironmentStringsA,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,StrCmpCA,CopyFileA,CopyFileA,Sleep,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 2_2_00406784
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00412BBE wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 2_2_00412BBE
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00409C78 wsprintfA,FindFirstFileA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 2_2_00409C78
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00408224 FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 2_2_00408224
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0041269A GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 2_2_0041269A
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00411883 SymMatchString,SymMatchString,SymMatchString,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 2_2_00411883
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: chrome.exe Memory has grown: Private usage: 1MB later: 31MB

Networking

barindex
Source: Network traffic Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.6:49718 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:49732 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:49726 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:49852 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.6:49714 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.75.209.106:443 -> 192.168.2.6:49718
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:49823 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:49823 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:49845 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:49845 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.75.209.106:443 -> 192.168.2.6:49719
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:49812 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:49919 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:49919 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:49897 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:49830 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:49830 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:49928 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:49928 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:49992 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:49954 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:49954 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50005 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:50005 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:49992 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50025 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:50025 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50052 -> 5.75.209.106:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50080 -> 5.75.209.106:443
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199819539662
Source: global traffic HTTP traffic detected: GET /sc1phell HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: Joe Sandbox View IP Address: 23.219.82.59 23.219.82.59
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknown HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49793 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00403C79 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle, 2_2_00403C79
Source: global traffic HTTP traffic detected: GET /sc1phell HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0Host: wedrain.buzzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"peek","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.738b92b9bec478fe5bba.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.55", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-full-version: "117.0.2045.55"sec-ch-dpr: 1ect: 4gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"peek","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=3801FA1EF8884F2284064984A6248185.RefC=2025-01-27T11:48:23Z; USRLOC=; MUID=395E6C08557669DA09DC79895414681F; MUIDB=395E6C08557669DA09DC79895414681F; _EDGE_S=F=1&SID=1504F1CAF2E8630B1041E44BF32E62CF; _EDGE_V=1
Source: global traffic HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.8ed343c804e9069b52b4.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.55", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-full-version: "117.0.2045.55"sec-ch-dpr: 1ect: 4gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"peek","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=3801FA1EF8884F2284064984A6248185.RefC=2025-01-27T11:48:23Z; USRLOC=; MUID=395E6C08557669DA09DC79895414681F; MUIDB=395E6C08557669DA09DC79895414681F; _EDGE_S=F=1&SID=1504F1CAF2E8630B1041E44BF32E62CF; _EDGE_V=1
Source: global traffic HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.a8bc96a9c4710d87d862.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.7fc3109769390e0f7912.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.f0002ac69cdf1b64fa8d.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.b7b89bf41d6912fa0a2d.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /crx/blobs/ASuc5ogPRKL8tx3dQfs1dkHX_CppAqh0Tn5nQICmti0WDdowFbxzb4bMYXQ7vmpG6w_BVfBHCoELKCIkw6-Li7I9_3_07STrwA780BfXejEeXXwYQlt_sgYVnM2mncYIEYAAxlKa5W_5sZ-5jibTNe_AlbSjcRuLUx2H/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=395E6C08557669DA09DC79895414681F; _EDGE_S=F=1&SID=1504F1CAF2E8630B1041E44BF32E62CF; _EDGE_V=1
Source: global traffic HTTP traffic detected: GET /b?rn=1737978508963&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=395E6C08557669DA09DC79895414681F&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /c.gif?rnd=1737978508963&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3801fa1ef8884f2284064984a6248185&activityId=3801fa1ef8884f2284064984a6248185&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=395E6C08557669DA09DC79895414681F; _EDGE_S=F=1&SID=1504F1CAF2E8630B1041E44BF32E62CF; _EDGE_V=1
Source: global traffic HTTP traffic detected: GET /b2?rn=1737978508963&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=395E6C08557669DA09DC79895414681F&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1BF5e27d688df7a1f564e201737978510; XID=1BF5e27d688df7a1f564e201737978510
Source: global traffic HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 5.15sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.55", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 200sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-full-version: "117.0.2045.55"sec-ch-dpr: 1ect: 4gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"peek","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=3801FA1EF8884F2284064984A6248185.RefC=2025-01-27T11:48:23Z; USRLOC=; MUID=395E6C08557669DA09DC79895414681F; MUIDB=395E6C08557669DA09DC79895414681F; _EDGE_S=F=1&SID=1504F1CAF2E8630B1041E44BF32E62CF; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=33065a71-539b-4a41-b639-6b3e63c0e5a4; ai_session=b6Vw7W1jc5NhHQ4WfCTKGQ|1737978508954|1737978508954; sptmarket_restored=en-GB||us|en-us|en-us|en||cf=8|RefA=3801FA1EF8884F2284064984A6248185.RefC=2025-01-27T11:48:23Z
Source: global traffic HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: */*Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":13,"imageId":"BB1msyCL","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"peek","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=3801FA1EF8884F2284064984A6248185.RefC=2025-01-27T11:48:23Z; USRLOC=; MUID=395E6C08557669DA09DC79895414681F; MUIDB=395E6C08557669DA09DC79895414681F; _EDGE_S=F=1&SID=1504F1CAF2E8630B1041E44BF32E62CF; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=33065a71-539b-4a41-b639-6b3e63c0e5a4; ai_session=b6Vw7W1jc5NhHQ4WfCTKGQ|1737978508954|1737978508954; sptmarket_restored=en-GB||us|en-us|en-us|en||cf=8|RefA=3801FA1EF8884F2284064984A6248185.RefC=2025-01-27T11:48:23Z
Source: global traffic HTTP traffic detected: GET /c.gif?rnd=1737978508963&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3801fa1ef8884f2284064984a6248185&activityId=3801fa1ef8884f2284064984a6248185&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=5C57DC219C00441AB95878233256D2BF&MUID=395E6C08557669DA09DC79895414681F HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=395E6C08557669DA09DC79895414681F; _EDGE_S=F=1&SID=1504F1CAF2E8630B1041E44BF32E62CF; _EDGE_V=1; SM=T; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: 1ec96727-d56d-4813-a9ef-34889f3ae44a.tmp.13.dr String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log0.13.dr String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log0.13.dr String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log0.13.dr String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000008.00000003.2238456719.00003FF0003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2238341813.00003FF000F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2238414847.00003FF000F20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000008.00000003.2238456719.00003FF0003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2238341813.00003FF000F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2238414847.00003FF000F20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000008.00000002.2317177987.00003FF0002D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: t.me
Source: global traffic DNS traffic detected: DNS query: wedrain.buzz
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: apis.google.com
Source: global traffic DNS traffic detected: DNS query: play.google.com
Source: global traffic DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic DNS traffic detected: DNS query: c.msn.com
Source: global traffic DNS traffic detected: DNS query: assets.msn.com
Source: global traffic DNS traffic detected: DNS query: api.msn.com
Source: global traffic DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: unknown HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----j5pp8q9zua1nymy5fctrUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0Host: wedrain.buzzContent-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319242823.00003FF00080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162z28
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000008.00000002.2318570595.00003FF00068C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317896631.00003FF0004B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318459059.00003FF000630000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317896631.00003FF0004B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000008.00000002.2318570595.00003FF00068C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317896631.00003FF0004B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318459059.00003FF000630000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000008.00000002.2318570595.00003FF00068C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000008.00000002.2318570595.00003FF00068C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000008.00000002.2318570595.00003FF00068C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317896631.00003FF0004B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000008.00000002.2318570595.00003FF00068C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317896631.00003FF0004B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318459059.00003FF000630000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317896631.00003FF0004B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317764414.00003FF000428000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317896631.00003FF0004B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318459059.00003FF000630000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319242823.00003FF00080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319242823.00003FF00080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000008.00000002.2318570595.00003FF00068C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317896631.00003FF0004B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318459059.00003FF000630000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318085027.00003FF000524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317896631.00003FF0004B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319242823.00003FF00080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318459059.00003FF000630000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317764414.00003FF000428000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319242823.00003FF00080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319242823.00003FF00080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317896631.00003FF0004B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317896631.00003FF0004B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317896631.00003FF0004B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319242823.00003FF00080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000008.00000002.2318532000.00003FF00066C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000008.00000002.2315600094.00003FF000092000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000008.00000003.2240142734.00003FF001034000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240060478.00003FF000FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240263580.00003FF000F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240301405.00003FF001050000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 00000008.00000002.2317267016.00003FF0002F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241723300.00003FF0003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240240319.00003FF001090000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240142734.00003FF001034000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240060478.00003FF000FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241414807.00003FF000F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2242173694.00003FF001130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240263580.00003FF000F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241343525.00003FF000A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2242272993.00003FF00120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240301405.00003FF001050000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241379773.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000008.00000002.2317267016.00003FF0002F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241723300.00003FF0003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240240319.00003FF001090000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240142734.00003FF001034000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240060478.00003FF000FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241414807.00003FF000F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2242173694.00003FF001130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240263580.00003FF000F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241343525.00003FF000A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2242272993.00003FF00120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240301405.00003FF001050000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241379773.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000008.00000002.2317267016.00003FF0002F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241723300.00003FF0003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240240319.00003FF001090000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240142734.00003FF001034000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240060478.00003FF000FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241414807.00003FF000F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2242173694.00003FF001130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240263580.00003FF000F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241343525.00003FF000A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2242272993.00003FF00120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240301405.00003FF001050000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241379773.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000008.00000002.2317267016.00003FF0002F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241723300.00003FF0003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240240319.00003FF001090000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240142734.00003FF001034000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240060478.00003FF000FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241414807.00003FF000F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2242173694.00003FF001130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240263580.00003FF000F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241343525.00003FF000A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2242272993.00003FF00120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2240301405.00003FF001050000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241379773.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000008.00000002.2319563007.00003FF000894000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
Source: chrome.exe, 00000008.00000002.2320073590.00003FF0009A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000008.00000002.2320255467.00003FF0009D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/
Source: Amcache.hve.6.dr String found in binary or memory: http://upx.sf.net
Source: chromecache_440.10.dr String found in binary or memory: http://www.broofa.com
Source: chrome.exe, 00000008.00000002.2320607399.00003FF000A38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.gstatic.com/generate_204
Source: NRKCZ1PSDM.exe, 00000002.00000002.2640109422.0000000003C55000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319134433.00003FF0007BC000.00000004.00000800.00020000.00000000.sdmp, 8gdtrq.2.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000008.00000002.2315724962.00003FF0000A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000008.00000002.2321619022.00003FF000C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317764414.00003FF000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317896631.00003FF0004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000008.00000002.2321619022.00003FF000C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2315380397.00003FF000014000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000008.00000002.2316375764.00003FF0001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000008.00000002.2316375764.00003FF0001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000008.00000002.2316375764.00003FF0001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000008.00000002.2316375764.00003FF0001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000008.00000003.2250170232.00003FF0002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000008.00000003.2250170232.00003FF0002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000008.00000003.2250170232.00003FF0002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000008.00000002.2315761632.00003FF0000C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000008.00000002.2315761632.00003FF0000C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000008.00000002.2315761632.00003FF0000C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000008.00000002.2315724962.00003FF0000A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chromecache_443.10.dr String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_443.10.dr String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000008.00000002.2316375764.00003FF0001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000008.00000002.2321619022.00003FF000C70000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com?
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319242823.00003FF00080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317896631.00003FF0004B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318459059.00003FF000630000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317896631.00003FF0004B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000008.00000003.2236365861.00003FF000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2235418666.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236317258.00003FF00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374292044.00005BDC00378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000008.00000003.2250170232.00003FF0002A4000.00000004.00000800.00020000.00000000.sdmp, chromecache_440.10.dr, chromecache_443.10.dr String found in binary or memory: https://apis.google.com
Source: chrome.exe, 00000008.00000002.2318532000.00003FF00066C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2315564980.00003FF000074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes
Source: msedge.exe, 0000000C.00000002.2450340093.000001817BD45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://arc.msn.com
Source: 2cc80dabc69f58b6_1.13.dr String found in binary or memory: https://assets.msn.cn/resolver/
Source: 00d98fb0-d4dc-43a5-a2d5-8c00d68ea338.tmp.15.dr String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.13.dr String found in binary or memory: https://assets.msn.com/resolver/
Source: 2cc80dabc69f58b6_1.13.dr String found in binary or memory: https://bit.ly/wb-precache
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2640782905.0000000003FC2000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2642102048.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, nyuk68.2.dr String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2640782905.0000000003FC2000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2642102048.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, nyuk68.2.dr String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.13.dr String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.13.dr String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.15.dr String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.13.dr String found in binary or memory: https://c.msn.com/
Source: chrome.exe, 00000008.00000002.2322184337.00003FF000D3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318055353.00003FF00050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318854079.00003FF00072C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000008.00000002.2317985614.00003FF0004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: NRKCZ1PSDM.exe, 00000002.00000002.2640109422.0000000003C55000.00000004.00000020.00020000.00000000.sdmp, 8gdtrq.2.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: offscreendocument_main.js.13.dr, service_worker_bin_prod.js.13.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/
Source: chrome.exe, 00000008.00000002.2321451214.00003FF000C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2294856478.00003FF000C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000008.00000002.2321451214.00003FF000C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2294856478.00003FF000C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: NRKCZ1PSDM.exe, 00000002.00000002.2640782905.0000000004024000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2640109422.0000000003C55000.00000004.00000020.00020000.00000000.sdmp, 2d2vas.2.dr, Web Data.13.dr, 8gdtrq.2.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000008.00000002.2321220864.00003FF000B7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000008.00000002.2321220864.00003FF000B7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000008.00000002.2321220864.00003FF000B7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: NRKCZ1PSDM.exe, 00000002.00000002.2640782905.0000000004024000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2640109422.0000000003C55000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2320073590.00003FF0009A0000.00000004.00000800.00020000.00000000.sdmp, 2d2vas.2.dr, Web Data.13.dr, 8gdtrq.2.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000008.00000003.2241574842.00003FF000490000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.2491014904.00005BDC00194000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000008.00000002.2318532000.00003FF00066C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000008.00000002.2320607399.00003FF000A38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321508172.00003FF000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2323745396.00003FF001114000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000008.00000002.2321508172.00003FF000C30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en_tests
Source: chrome.exe, 00000008.00000002.2321508172.00003FF000C30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=enesult
Source: chrome.exe, 00000008.00000003.2237697094.00003FF000EAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321657542.00003FF000CAB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2239873124.00003FF000EAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2237132122.00003FF000490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236666102.00003FF000490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2248252354.00003FF000CB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2239939194.00003FF000CB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241574842.00003FF000490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000008.00000002.2328262926.00006C140078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000008.00000003.2264030945.00006C140080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2227439180.00006C1400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000008.00000002.2328262926.00006C140078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000008.00000003.2264030945.00006C140080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2227439180.00006C1400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000008.00000002.2328262926.00006C140078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2328262926.00006C140078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2228019822.00006C1400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000008.00000003.2264030945.00006C140080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2227439180.00006C1400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000008.00000002.2316136001.00003FF00017C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.2491014904.00005BDC00194000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.13.dr String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000008.00000002.2321619022.00003FF000C70000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000008.00000002.2316375764.00003FF0001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000008.00000002.2316375764.00003FF0001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/g
Source: 00d98fb0-d4dc-43a5-a2d5-8c00d68ea338.tmp.15.dr String found in binary or memory: https://clients2.google.com
Source: chrome.exe, 00000008.00000003.2223926441.00000F88002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2223943419.00000F88002E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000008.00000002.2318570595.00003FF00068C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2231449923.00003FF0004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321508172.00003FF000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2315492029.00003FF00003C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2320483916.00003FF000A30000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.2490087452.00005BDC00040000.00000004.00000800.00020000.00000000.sdmp, manifest.json.13.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 00d98fb0-d4dc-43a5-a2d5-8c00d68ea338.tmp.15.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: chrome.exe, 00000008.00000002.2320073590.00003FF0009A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000008.00000002.2320073590.00003FF0009A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000008.00000002.2318854079.00003FF00072C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000008.00000002.2316375764.00003FF0001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000008.00000002.2316375764.00003FF0001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chromecache_443.10.dr String found in binary or memory: https://clients6.google.com
Source: chrome.exe, 00000008.00000002.2318532000.00003FF00066C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chromecache_443.10.dr String found in binary or memory: https://content.googleapis.com
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2640782905.0000000003FC2000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2642102048.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, nyuk68.2.dr String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2640782905.0000000003FC2000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2642102048.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, nyuk68.2.dr String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000008.00000002.2322591169.00003FF000DF4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1
Source: chrome.exe, 00000008.00000002.2320845736.00003FF000AC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: Reporting and NEL.15.dr String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.13.dr String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.15.dr String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: chrome.exe, 00000008.00000002.2317380560.00003FF000318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.
Source: manifest.json.13.dr String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview2K
Source: chrome.exe, 00000008.00000002.2317825145.00003FF000484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000008.00000002.2319134433.00003FF0007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319171726.00003FF0007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317985614.00003FF0004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321589824.00003FF000C5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000008.00000002.2319134433.00003FF0007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319171726.00003FF0007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317985614.00003FF0004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321589824.00003FF000C5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000008.00000002.2319134433.00003FF0007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319171726.00003FF0007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317985614.00003FF0004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321589824.00003FF000C5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000008.00000002.2317825145.00003FF000484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000008.00000002.2322184337.00003FF000D3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318055353.00003FF00050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318854079.00003FF00072C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000008.00000002.2317825145.00003FF000484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000008.00000002.2322184337.00003FF000D3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318055353.00003FF00050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318854079.00003FF00072C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000008.00000002.2322184337.00003FF000D3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actionsiU
Source: chromecache_443.10.dr String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json.13.dr String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.13.dr String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000008.00000002.2317380560.00003FF000318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-1.corp.google.c
Source: manifest.json.13.dr String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.13.dr String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000008.00000002.2317380560.00003FF000318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.googl
Source: manifest.json.13.dr String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.13.dr String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.13.dr String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.13.dr String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.13.dr String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.13.dr String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000008.00000003.2242272993.00003FF00120C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: manifest.json.13.dr String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000008.00000002.2317586113.00003FF0003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321451214.00003FF000C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2294856478.00003FF000C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000008.00000002.2319134433.00003FF0007BC000.00000004.00000800.00020000.00000000.sdmp, 2d2vas.2.dr, Web Data.13.dr, 8gdtrq.2.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: NRKCZ1PSDM.exe, 00000002.00000002.2640782905.0000000004024000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2640109422.0000000003C55000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321451214.00003FF000C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2294856478.00003FF000C0C000.00000004.00000800.00020000.00000000.sdmp, 2d2vas.2.dr, Web Data.13.dr, 8gdtrq.2.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000008.00000002.2321451214.00003FF000C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2294856478.00003FF000C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: NRKCZ1PSDM.exe, 00000002.00000002.2640782905.0000000004024000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2640109422.0000000003C55000.00000004.00000020.00020000.00000000.sdmp, 2d2vas.2.dr, Web Data.13.dr, 8gdtrq.2.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000008.00000002.2321451214.00003FF000C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2294856478.00003FF000C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icondTripTime
Source: 000003.log0.13.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log0.13.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log0.13.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log.13.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: HubApps Icons.13.dr, 1ec96727-d56d-4813-a9ef-34889f3ae44a.tmp.13.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: HubApps Icons.13.dr, 1ec96727-d56d-4813-a9ef-34889f3ae44a.tmp.13.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 1ec96727-d56d-4813-a9ef-34889f3ae44a.tmp.13.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 1ec96727-d56d-4813-a9ef-34889f3ae44a.tmp.13.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: HubApps Icons.13.dr, 1ec96727-d56d-4813-a9ef-34889f3ae44a.tmp.13.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: HubApps Icons.13.dr, 1ec96727-d56d-4813-a9ef-34889f3ae44a.tmp.13.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 000003.log0.13.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: HubApps Icons.13.dr, 1ec96727-d56d-4813-a9ef-34889f3ae44a.tmp.13.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: HubApps Icons.13.dr, 1ec96727-d56d-4813-a9ef-34889f3ae44a.tmp.13.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: HubApps Icons.13.dr, 1ec96727-d56d-4813-a9ef-34889f3ae44a.tmp.13.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: HubApps Icons.13.dr, 1ec96727-d56d-4813-a9ef-34889f3ae44a.tmp.13.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 000003.log0.13.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: chromecache_440.10.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_440.10.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_440.10.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_440.10.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/(l
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com//l
Source: chrome.exe, 00000008.00000003.2264030945.00006C140080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2227439180.00006C1400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2l
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/9l
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Cj
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Fj
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Mj
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Pj
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Wj
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Zj
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/aj
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/dj
Source: chrome.exe, 00000008.00000003.2228019822.00006C1400684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gj
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/kj
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/nj
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/vi
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/xj
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2328262926.00006C140078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2228019822.00006C1400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000008.00000003.2264030945.00006C140080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2227439180.00006C1400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000008.00000003.2228019822.00006C1400684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000008.00000003.2228019822.00006C1400684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000008.00000003.2228019822.00006C1400684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/l
Source: chrome.exe, 00000008.00000002.2328262926.00006C140078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2263524903.00003FF001A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2263621235.00003FF001A1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000008.00000003.2264030945.00006C140080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2227439180.00006C1400390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: msedge.exe, 0000000C.00000002.2491404749.00005BDC003A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: chrome.exe, 00000008.00000002.2316375764.00003FF0001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000008.00000002.2318494043.00003FF000648000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: 2cc80dabc69f58b6_1.13.dr String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.13.dr String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: nyuk68.2.dr String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000008.00000002.2321532705.00003FF000C3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444preferSkippingInvalidateForEmulatedFormats
Source: msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 0000000C.00000003.2374932389.00005BDC00364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000008.00000002.2319134433.00003FF0007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319171726.00003FF0007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317985614.00003FF0004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321589824.00003FF000C5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000008.00000002.2319134433.00003FF0007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319171726.00003FF0007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317985614.00003FF0004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321589824.00003FF000C5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000008.00000002.2325637359.00006C1400238000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000008.00000002.2325637359.00006C1400238000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000008.00000003.2264030945.00006C140080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2227439180.00006C1400390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000008.00000002.2324722891.00003FF001858000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard?
Source: chrome.exe, 00000008.00000003.2264030945.00006C140080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2227439180.00006C1400390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000008.00000002.2328022530.00006C1400770000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000008.00000002.2325637359.00006C1400238000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardl
Source: chrome.exe, 00000008.00000002.2328022530.00006C1400770000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000008.00000002.2317764414.00003FF000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2260576939.00003FF00132C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000008.00000003.2241723300.00003FF0003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2242173694.00003FF001130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2242272993.00003FF00120C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000008.00000003.2241723300.00003FF0003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2242173694.00003FF001130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2242272993.00003FF00120C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000008.00000003.2228473403.00006C14006EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241723300.00003FF0003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2327901093.00006C1400744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2328262926.00006C140078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2242173694.00003FF001130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2242272993.00003FF00120C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000008.00000003.2227439180.00006C1400390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000008.00000002.2328262926.00006C140078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000008.00000002.2328262926.00006C140078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000008.00000002.2327901093.00006C1400744000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000008.00000002.2316375764.00003FF0001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000008.00000002.2317764414.00003FF000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2260576939.00003FF00132C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?tab=rm&amp;ogbl
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000008.00000002.2317586113.00003FF0003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: msedge.exe, 0000000C.00000002.2491404749.00005BDC003A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://msn.cn/
Source: msedge.exe, 0000000C.00000002.2491404749.00005BDC003A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://msn.com/
Source: Cookies.15.dr String found in binary or memory: https://msn.comXID/
Source: Cookies.15.dr String found in binary or memory: https://msn.comXIDv10
Source: chrome.exe, 00000008.00000002.2322184337.00003FF000D3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318055353.00003FF00050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318854079.00003FF00072C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000008.00000002.2317951492.00003FF0004C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319032202.00003FF00078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321558582.00003FF000C48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000008.00000003.2241414807.00003FF000F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317951492.00003FF0004C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2323275472.00003FF000F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2255012246.00003FF000F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319032202.00003FF00078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2262651817.00003FF000F6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000008.00000003.2241414807.00003FF000F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2323275472.00003FF000F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2255012246.00003FF000F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2262651817.00003FF000F6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhonetp
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/shielded-email?utm_source=chrome
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/shielded-email?utm_source=chrome2B
Source: chrome.exe, 00000008.00000002.2321220864.00003FF000B7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319032202.00003FF00078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000008.00000002.2320030331.00003FF000988000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2320073590.00003FF0009B7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2238885459.00003FF000F7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myactivity.google.com/
Source: 2cc80dabc69f58b6_1.13.dr String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log5.13.dr String found in binary or memory: https://ntp.msn.com
Source: 000003.log2.13.dr String found in binary or memory: https://ntp.msn.com/
Source: 000003.log2.13.dr String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.13.dr String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.13.dr, 000003.log2.13.dr String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log2.13.dr String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13382452104040070.13.dr String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.13.dr String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.13.dr String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chrome.exe, 00000008.00000002.2316375764.00003FF0001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 0000000C.00000002.2491404749.00005BDC003A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://office.net/
Source: chrome.exe, 00000008.00000003.2260576939.00003FF00132C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000008.00000002.2320970653.00003FF000B18000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000008.00000003.2260576939.00003FF00132C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000008.00000003.2260576939.00003FF00132C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000008.00000002.2318133432.00003FF000574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236891342.00003FF000A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2324181652.00003FF00129C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000008.00000002.2323036057.00003FF000ED4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236891342.00003FF000A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000008.00000002.2323036057.00003FF000ED4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236891342.00003FF000A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000008.00000002.2322651415.00003FF000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236891342.00003FF000A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000008.00000002.2324645614.00003FF00181C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236891342.00003FF000A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000008.00000002.2317177987.00003FF0002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2322651415.00003FF000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2322322860.00003FF000D94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2322780181.00003FF000E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236891342.00003FF000A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000008.00000002.2322651415.00003FF000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2322780181.00003FF000E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236891342.00003FF000A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000008.00000002.2323036057.00003FF000ED4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2236891342.00003FF000A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000008.00000002.2317985614.00003FF0004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: msedge.exe, 0000000C.00000003.2374770568.00005BDC00284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 0000000C.00000003.2374163146.00005BDC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374247098.00005BDC00280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374770568.00005BDC00284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 0000000C.00000003.2374163146.00005BDC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374247098.00005BDC00280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374770568.00005BDC00284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 0000000C.00000003.2374163146.00005BDC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374247098.00005BDC00280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374770568.00005BDC00284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 0000000C.00000003.2374770568.00005BDC00284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 0000000C.00000003.2374163146.00005BDC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374247098.00005BDC00280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374770568.00005BDC00284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 0000000C.00000003.2374163146.00005BDC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374247098.00005BDC00280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374770568.00005BDC00284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 0000000C.00000003.2374163146.00005BDC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374247098.00005BDC00280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374770568.00005BDC00284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 0000000C.00000003.2374163146.00005BDC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374247098.00005BDC00280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374770568.00005BDC00284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 0000000C.00000003.2374163146.00005BDC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374247098.00005BDC00280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374770568.00005BDC00284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 0000000C.00000003.2374163146.00005BDC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374247098.00005BDC00280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374770568.00005BDC00284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 0000000C.00000003.2374163146.00005BDC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374247098.00005BDC00280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374770568.00005BDC00284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 0000000C.00000003.2374163146.00005BDC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374247098.00005BDC00280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374770568.00005BDC00284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 0000000C.00000003.2374163146.00005BDC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374247098.00005BDC00280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2374770568.00005BDC00284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000008.00000002.2320030331.00003FF000988000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2320073590.00003FF0009B7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2238885459.00003FF000F7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000008.00000003.2241723300.00003FF0003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2242173694.00003FF001130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2242272993.00003FF00120C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chromecache_440.10.dr String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chrome.exe, 00000008.00000002.2321589824.00003FF000C5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://play.google.com/log?format=json&hasfast=true?
Source: chromecache_443.10.dr String found in binary or memory: https://plus.google.com
Source: chromecache_443.10.dr String found in binary or memory: https://plus.googleapis.com
Source: chrome.exe, 00000008.00000002.2320030331.00003FF000988000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2320073590.00003FF0009B7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2238885459.00003FF000F7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000008.00000002.2315724962.00003FF0000A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: 2cc80dabc69f58b6_1.13.dr String found in binary or memory: https://sb.scorecardresearch.com/
Source: chrome.exe, 00000008.00000002.2315600094.00003FF000080000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000008.00000002.2316375764.00003FF0001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldedids-pa.googleapis.comb
Source: chrome.exe, 00000008.00000002.2319134433.00003FF0007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319171726.00003FF0007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317985614.00003FF0004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321589824.00003FF000C5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000008.00000002.2319134433.00003FF0007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319171726.00003FF0007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317985614.00003FF0004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321589824.00003FF000C5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: 2cc80dabc69f58b6_1.13.dr String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.13.dr String found in binary or memory: https://srtb.msn.com/
Source: chrome.exe, 00000008.00000003.2250170232.00003FF0002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000008.00000002.2317764414.00003FF000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2260576939.00003FF00132C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: NRKCZ1PSDM.exe, NRKCZ1PSDM.exe, 00000002.00000002.2637808939.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199819539662
Source: NRKCZ1PSDM.exe, 00000002.00000002.2637808939.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199819539662go2dnizMozilla/5.0
Source: NRKCZ1PSDM.exe, 00000002.00000002.2643251604.00000000044DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: NRKCZ1PSDM.exe, 00000002.00000002.2643251604.00000000044DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.00000000010C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.00000000010C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/C
Source: NRKCZ1PSDM.exe, NRKCZ1PSDM.exe, 00000002.00000002.2638887572.0000000001116000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2637808939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2638887572.0000000001107000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/sc1phell
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.0000000001116000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/sc1phell9
Source: NRKCZ1PSDM.exe, 00000002.00000002.2637808939.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/sc1phellgo2dnizMozilla/5.0
Source: chrome.exe, 00000008.00000002.2320607399.00003FF000A38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000008.00000002.2316375764.00003FF0001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tasks.googleapis.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.0000000001107000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.telegram.org
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.0000000001107000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2638887572.0000000001130000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2642102048.00000000042BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wedrain.buzz
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.0000000001130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wedrain.buzz.
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wedrain.buzz/
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wedrain.buzz/Z
Source: chromecache_443.10.dr String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2640782905.0000000003FC2000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2642102048.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, nyuk68.2.dr String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: NRKCZ1PSDM.exe, 00000002.00000002.2640109422.0000000003C55000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2317896631.00003FF0004B0000.00000004.00000800.00020000.00000000.sdmp, 8gdtrq.2.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000008.00000002.2321451214.00003FF000C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2294856478.00003FF000C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000008.00000002.2321451214.00003FF000C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2294856478.00003FF000C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000008.00000002.2321451214.00003FF000C10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2294856478.00003FF000C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000008.00000003.2250170232.00003FF0002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000008.00000003.2250170232.00003FF0002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000008.00000003.2250170232.00003FF0002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000008.00000003.2239939194.00003FF000CB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2241574842.00003FF000490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2320740737.00003FF000A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2238885459.00003FF000F7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000008.00000002.2321290782.00003FF000B90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000008.00000002.2319242823.00003FF00080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/Char9e3
Source: chrome.exe, 00000008.00000002.2321589824.00003FF000C5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000008.00000002.2322296146.00003FF000D88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/newtab_promos
Source: content_new.js.13.dr, content.js.13.dr String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000008.00000002.2316375764.00003FF0001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319171726.00003FF0007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2323350517.00003FF000FF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319943128.00003FF00095C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000008.00000002.2316375764.00003FF0001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319171726.00003FF0007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2323350517.00003FF000FF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319943128.00003FF00095C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: NRKCZ1PSDM.exe, 00000002.00000002.2640782905.0000000004024000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2640109422.0000000003C55000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2321341192.00003FF000BCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318306905.00003FF0005D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318055353.00003FF00050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2318854079.00003FF00072C000.00000004.00000800.00020000.00000000.sdmp, 2d2vas.2.dr, Web Data.13.dr, 8gdtrq.2.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000008.00000002.2317764414.00003FF000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2260576939.00003FF00132C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/imghp?hl=en&amp;tab=ri&amp;ogbl
Source: chrome.exe, 00000008.00000003.2260576939.00003FF00132C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000008.00000003.2242272993.00003FF00120C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000008.00000002.2317985614.00003FF0004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000008.00000002.2317985614.00003FF0004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit?
Source: chrome.exe, 00000008.00000002.2320740737.00003FF000A70000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000008.00000003.2250170232.00003FF0002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: 00d98fb0-d4dc-43a5-a2d5-8c00d68ea338.tmp.15.dr String found in binary or memory: https://www.googleapis.com
Source: chrome.exe, 00000008.00000002.2315380397.00003FF000014000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chromecache_443.10.dr String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_443.10.dr String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chrome.exe, 00000008.00000003.2265229542.00003FF00159C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265287631.00003FF0015A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265199281.00003FF001594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265730884.00003FF0015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2265164978.00003FF001590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000008.00000003.2262583061.00003FF00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000008.00000002.2316631721.00003FF00020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000008.00000003.2250170232.00003FF0002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000008.00000003.2250170232.00003FF0002A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000008.00000002.2317985614.00003FF0004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chromecache_440.10.dr String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_440.10.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_440.10.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chrome.exe, 00000008.00000003.2260576939.00003FF00132C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000008.00000003.2255471289.00003FF0013E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2254918459.00003FF001310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2260932621.00003FF00140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2324349611.00003FF001364000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2258803539.00003FF00135C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2260536399.00003FF001310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2255064788.00003FF001310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000003.2260576939.00003FF00132C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000008.00000003.2260576939.00003FF00132C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.49JL8PttH04.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000008.00000003.2260576939.00003FF00132C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.avVfaMsGWq0.L.W.O/m=qmd
Source: NRKCZ1PSDM.exe, 00000002.00000002.2643251604.00000000044DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: NRKCZ1PSDM.exe, 00000002.00000002.2643251604.00000000044DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: NRKCZ1PSDM.exe, 00000002.00000002.2643251604.00000000044DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.13.dr String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2640782905.0000000003FC2000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2642102048.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, nyuk68.2.dr String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000008.00000002.2317177987.00003FF0002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000008.00000002.2319032202.00003FF0007A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown Network traffic detected: HTTP traffic on port 49888 -> 443
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.209.106:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49868 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50074 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50125 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50132 version: TLS 1.2
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0040EAB5 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow, 2_2_0040EAB5
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00405AD3 memcpy,OpenDesktopA,CreateDesktopA,lstrcpyA,CreateProcessA,Sleep,CloseDesktop, 2_2_00405AD3

System Summary

barindex
Source: 2.2.NRKCZ1PSDM.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 2.2.NRKCZ1PSDM.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 0.2.NRKCZ1PSDM.exe.3df9550.0.raw.unpack, type: UNPACKEDPE Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 00000002.00000002.2637808939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 0_2_01011F0F 0_2_01011F0F
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00404B3F 2_2_00404B3F
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00414F57 2_2_00414F57
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00417B66 2_2_00417B66
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0040AF7E 2_2_0040AF7E
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00416FF1 2_2_00416FF1
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_004151BF 2_2_004151BF
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: String function: 0040D84A appears 139 times
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6540 -ip 6540
Source: NRKCZ1PSDM.exe, 00000000.00000000.2108428217.00000000007D8000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameUSERINIT.EXEj% vs NRKCZ1PSDM.exe
Source: NRKCZ1PSDM.exe, 00000000.00000002.2156807017.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs NRKCZ1PSDM.exe
Source: NRKCZ1PSDM.exe, 00000000.00000002.2162926184.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUSERINIT.EXEj% vs NRKCZ1PSDM.exe
Source: NRKCZ1PSDM.exe, 00000002.00000002.2642102048.00000000042BD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs NRKCZ1PSDM.exe
Source: NRKCZ1PSDM.exe Binary or memory string: OriginalFilenameUSERINIT.EXEj% vs NRKCZ1PSDM.exe
Source: NRKCZ1PSDM.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: 2.2.NRKCZ1PSDM.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 2.2.NRKCZ1PSDM.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 0.2.NRKCZ1PSDM.exe.3df9550.0.raw.unpack, type: UNPACKEDPE Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 00000002.00000002.2637808939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: NRKCZ1PSDM.exe Static PE information: Section: .bsS ZLIB complexity 1.0003759152719665
Source: NRKCZ1PSDM.exe, WS36uhldRk15BMqR9l.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.NRKCZ1PSDM.exe.3df9550.0.raw.unpack, WS36uhldRk15BMqR9l.cs Cryptographic APIs: 'CreateDecryptor'
Source: NRKCZ1PSDM.exe, Program.cs Base64 encoded string: 'YzMyMTVmZTM3MmQwNWZjMDkxNzY2NTRiZGEyYzhhMDIyZjY2ZTg1MDBkN2U4OWNmYTliM2NmNTkzYjY5MjVmZQ=='
Source: 0.2.NRKCZ1PSDM.exe.3df9550.0.raw.unpack, Program.cs Base64 encoded string: 'YzMyMTVmZTM3MmQwNWZjMDkxNzY2NTRiZGEyYzhhMDIyZjY2ZTg1MDBkN2U4OWNmYTliM2NmNTkzYjY5MjVmZQ=='
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@77/281@28/23
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0040F029 CreateToolhelp32Snapshot,Process32First,StrCmpCA,Process32Next,StrCmpCA,CloseHandle, 2_2_0040F029
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\DPSID14P.htm Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6540
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8860:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\5ef21536-35bf-4123-8ce2-fe651b5931af Jump to behavior
Source: NRKCZ1PSDM.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: NRKCZ1PSDM.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: chrome.exe, 00000008.00000002.2317678088.00003FF00041F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: o8gva1vkf.2.dr, nozukfct0.2.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: NRKCZ1PSDM.exe Virustotal: Detection: 48%
Source: NRKCZ1PSDM.exe ReversingLabs: Detection: 55%
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File read: C:\Users\user\Desktop\NRKCZ1PSDM.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\NRKCZ1PSDM.exe "C:\Users\user\Desktop\NRKCZ1PSDM.exe"
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process created: C:\Users\user\Desktop\NRKCZ1PSDM.exe "C:\Users\user\Desktop\NRKCZ1PSDM.exe"
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6540 -ip 6540
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 932
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2224,i,17690434404087868942,431523193786987601,262144 /prefetch:8
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: unknown Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2616 --field-trial-handle=2436,i,9721904846499961303,14666363657862644013,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2988 --field-trial-handle=1956,i,10612431315557657035,2972395015528332857,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7088 --field-trial-handle=1956,i,10612431315557657035,2972395015528332857,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7248 --field-trial-handle=1956,i,10612431315557657035,2972395015528332857,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7524 --field-trial-handle=1956,i,10612431315557657035,2972395015528332857,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7524 --field-trial-handle=1956,i,10612431315557657035,2972395015528332857,262144 /prefetch:8
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\NRKCZ1PSDM.exe" & rd /s /q "C:\ProgramData\djecj" & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7104 --field-trial-handle=1956,i,10612431315557657035,2972395015528332857,262144 /prefetch:8
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process created: C:\Users\user\Desktop\NRKCZ1PSDM.exe "C:\Users\user\Desktop\NRKCZ1PSDM.exe" Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6540 -ip 6540 Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\NRKCZ1PSDM.exe" & rd /s /q "C:\ProgramData\djecj" & exit Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2224,i,17690434404087868942,431523193786987601,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2616 --field-trial-handle=2436,i,9721904846499961303,14666363657862644013,262144 /prefetch:3 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2988 --field-trial-handle=1956,i,10612431315557657035,2972395015528332857,262144 /prefetch:3 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7088 --field-trial-handle=1956,i,10612431315557657035,2972395015528332857,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7248 --field-trial-handle=1956,i,10612431315557657035,2972395015528332857,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7524 --field-trial-handle=1956,i,10612431315557657035,2972395015528332857,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7524 --field-trial-handle=1956,i,10612431315557657035,2972395015528332857,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7104 --field-trial-handle=1956,i,10612431315557657035,2972395015528332857,262144 /prefetch:8 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe Section loaded: version.dll
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: NRKCZ1PSDM.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: NRKCZ1PSDM.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: NRKCZ1PSDM.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: System.Windows.Forms.pdb source: WER546.tmp.dmp.6.dr
Source: Binary string: vdr1.pdb source: NRKCZ1PSDM.exe, NRKCZ1PSDM.exe, 00000002.00000002.2637808939.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb source: WER546.tmp.dmp.6.dr
Source: Binary string: System.ni.pdbRSDS source: WER546.tmp.dmp.6.dr
Source: Binary string: A{"id":1,"method":"Storage.getCookies"}|.tgz.gzSecurityHistoryWork Dir: In memorySOFTWARE\Microsoft\Cryptographyfirefox%08lX%04lX%lu_key.txtSoft\Steam\steam_tokens.txt\Discord\tokens.txtpasswords.txtinformation.txtlocalhostWebSocketClient" & exitGdipGetImageHeightSoftGdipGetImagePixelFormatN0ZWFt\Monero\wallet.keysAzure\.awsstatusWallets_CreateProcessGdipGetImageEncodershttpsSoftware\Martin Prikryl\WinSCP 2\SessionsPlugins/devtoolsprefs.jsLocal Extension SettingsSync Extension SettingsFilescookiesCookies\BraveWallet\Preferenceskey_datas%s\%s\%sPortNumberCurrentBuildNumberGdiplusStartup.zipGdipCreateHBITMAPFromBitmapOpera Crypto.zooUnknownGdiplusShutdown/json_logins.jsoninvalid string positionSoftware\Martin Prikryl\WinSCP 2\ConfigurationDisplayVersionSOFTWARE\Microsoft\Windows NT\CurrentVersionopentokenamcommunity.comTelegramSoftware\Valve\SteamGdipSaveImageToStreamGdipLoadImageFromStream\AppData\Roaming\FileZilla\recentservers.xml.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallapprove_aprilNetworkblock.arjprofiles.ini.lzhGdipGetImageWidthwallet_pathSteamPathscreenshot.jpgstring too longvector<T> too longProcessorNameStringloginusers.vdflibraryfolders.vdfconfig.vdfDialogConfig.vdfDialogConfigOverlay*.vdfGdipGetImageEncodersSizesteam.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\cmd.exeC:\Windows\system32\rundll32.exeBravetrueformhistory.sqlitecookies.sqliteplaces.sqliteLocal StatefalseAzure\.azureSOFTWARE\monero-project\monero-corechromefile_nameDisplayNameHostNameProductNameUserNameGdipSaveImageToFilemsal.cacheGdipDisposeImagemodeAzure\.IdentityServiceUseMasterPasswordhwidMachineGuidtask_idbuild_idCrash DetectedDisabled%dx%d%d/%d/%d %d:%d:%d.arcvdr1.pdb\Local Storage\leveldb_0.indexeddb.leveldb_formhistory.db_history.db_cookies.db_passwords.db_webdata.db_key4.db\key4.dbfile_dataLogin DataWeb DataoperaOperachrome-extension_[Processes][Software]\storage\default\\.aws\errors\\Telegram Desktop\\Steam\\config\\.azure\ Stable\\.IdentityService\\discord\/c timeout /t 10 & rd /s /q "C:\ProgramData\" & rd /s /q "C:\ProgramData\\..\.ZDISPLAYOpera GXEXCEPTION_INT_OVERFLOWEXCEPTION_FLT_OVERFLOWEXCEPTION_STACK_OVERFLOWEXCEPTION_FLT_UNDERFLOWPOSTEXCEPTION_BREAKPOINT\Local Storage\leveldb\CURRENTEXCEPTION_DATATYPE_MISALIGNMENTEXCEPTION_FLT_INEXACT_RESULTGETEXCEPTION_IN_PAGE_ERRORdQw4w9WgXcQEXCEPTION_SINGLE_STEPGdipCreateBitmapFromHBITMAPEXCEPTION_INT_DIVIDE_BY_ZEROEXCEPTION_FLT_DIVIDE_BY_ZEROEXCEPTION_NONCONTINUABLE_EXCEPTIONUNKNOWN EXCEPTIONEXCEPTION_INVALID_DISPOSITIONEXCEPTION_PRIV_INSTRUCTIONEXCEPTION_ILLEGAL_INSTRUCTIONEXCEPTION_FLT_INVALID_OPERATIONEXCEPTION_ACCESS_VIOLATIONEXCEPTION_FLT_STACK_CHECKEXCEPTION_FLT_DENORMAL_OPERANDEXCEPTION_ARRAY_BOUNDS_EXCEEDED%d MBIndexedDBOCALAPPDATA?<Host><Port><User><Pass encoding="base64">http://localhost:"webSocketDebuggerUrl":6^userContextId=4294967295465 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73ws://localhost:9223.metadata-v2:22.ps15121Windows 11HTTP/1.1HARDWA
Source: Binary string: Excited.pdb! source: WER546.tmp.dmp.6.dr
Source: Binary string: mscorlib.ni.pdb source: WER546.tmp.dmp.6.dr
Source: Binary string: System.Core.pdb source: WER546.tmp.dmp.6.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WER546.tmp.dmp.6.dr
Source: Binary string: System.Windows.Forms.pdbt- source: WER546.tmp.dmp.6.dr
Source: Binary string: System.pdb< source: WER546.tmp.dmp.6.dr
Source: Binary string: Excited.pdb source: NRKCZ1PSDM.exe, WER546.tmp.dmp.6.dr
Source: Binary string: System.ni.pdb source: WER546.tmp.dmp.6.dr
Source: Binary string: System.pdb source: WER546.tmp.dmp.6.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WER546.tmp.dmp.6.dr
Source: Binary string: System.Core.ni.pdb source: WER546.tmp.dmp.6.dr

Data Obfuscation

barindex
Source: NRKCZ1PSDM.exe, WS36uhldRk15BMqR9l.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{QCGNJZTm7XRc6fgjQf0(typeof(IntPtr).TypeHandle),typeof(Type)})
Source: 0.2.NRKCZ1PSDM.exe.3df9550.0.raw.unpack, WS36uhldRk15BMqR9l.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{QCGNJZTm7XRc6fgjQf0(typeof(IntPtr).TypeHandle),typeof(Type)})
Source: NRKCZ1PSDM.exe, QcapXlsQaOUTcM6d72A.cs .Net Code: IXR09cJLII
Source: NRKCZ1PSDM.exe, QcapXlsQaOUTcM6d72A.cs .Net Code: vK9cjiltfI
Source: 0.2.NRKCZ1PSDM.exe.3df9550.0.raw.unpack, QcapXlsQaOUTcM6d72A.cs .Net Code: IXR09cJLII
Source: 0.2.NRKCZ1PSDM.exe.3df9550.0.raw.unpack, QcapXlsQaOUTcM6d72A.cs .Net Code: vK9cjiltfI
Source: NRKCZ1PSDM.exe Static PE information: 0xE73D5611 [Mon Dec 8 06:37:05 2092 UTC]
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0040E886 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 2_2_0040E886
Source: NRKCZ1PSDM.exe Static PE information: real checksum: 0x42662 should be: 0x632f9
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 0_2_01010015 push ss; iretd 0_2_01010016
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 0_2_01017BA6 push ecx; ret 0_2_01017BB2
Source: NRKCZ1PSDM.exe, SX7VHXsUw02CIOBEHMt.cs High entropy of concatenated method names: 'yPnsD4TnOx', 'dXusyMG1aA', 'o3ismIfVR8', 'kP1sEIhXrK', 'mqfska4Qvx', 'C36sotIQsQ', 'rRasPCPoK8', 'sBqs8LZ6Rt', 'nPqs79L3Nh', 'FFrsbQX4xG'
Source: NRKCZ1PSDM.exe, QcapXlsQaOUTcM6d72A.cs High entropy of concatenated method names: 'XxeM7tarU5', 'vinMbvFplH', 'cViMQb2cJK', 'u9uMv6dVWb', 'MLbMViHlSa', 'FomMifG1RJ', 'LtkMA23hmd', 'bxaXX4VaGP', 'qg9MSmYjxU', 'quVMBikCSy'
Source: NRKCZ1PSDM.exe, T4D7CLsdBY5USblHXPJ.cs High entropy of concatenated method names: 'G7d1a0Fg4E', 'QW8QRVdM9XhwD4KOpJ0', 'peIfPNdNCG1d3DZTxSe', 'tTJfgtdukweQE8CgfnF', 'cM23bAdxoF512v5GYph', 'MWmxkkdc2ljstBYdFqI'
Source: NRKCZ1PSDM.exe, WS36uhldRk15BMqR9l.cs High entropy of concatenated method names: 'WafGmnTa34nDiqJLIUu', 'sNkakTTqkS3CcudO9wQ', 'tWmg2rjfPX', 'rQ7XTBTG9J2qD190dlr', 'fHWlxHTOrZ80BKuh86A', 'WiRsW5T4Jm2UFiKVXmh', 'Y3sBLUTtw3jwZSiZsYl', 'nW4lBacjpc', 'BRLsfrdFc8', 'tHFsgjAiBB'
Source: 0.2.NRKCZ1PSDM.exe.3df9550.0.raw.unpack, SX7VHXsUw02CIOBEHMt.cs High entropy of concatenated method names: 'yPnsD4TnOx', 'dXusyMG1aA', 'o3ismIfVR8', 'kP1sEIhXrK', 'mqfska4Qvx', 'C36sotIQsQ', 'rRasPCPoK8', 'sBqs8LZ6Rt', 'nPqs79L3Nh', 'FFrsbQX4xG'
Source: 0.2.NRKCZ1PSDM.exe.3df9550.0.raw.unpack, QcapXlsQaOUTcM6d72A.cs High entropy of concatenated method names: 'XxeM7tarU5', 'vinMbvFplH', 'cViMQb2cJK', 'u9uMv6dVWb', 'MLbMViHlSa', 'FomMifG1RJ', 'LtkMA23hmd', 'bxaXX4VaGP', 'qg9MSmYjxU', 'quVMBikCSy'
Source: 0.2.NRKCZ1PSDM.exe.3df9550.0.raw.unpack, T4D7CLsdBY5USblHXPJ.cs High entropy of concatenated method names: 'G7d1a0Fg4E', 'QW8QRVdM9XhwD4KOpJ0', 'peIfPNdNCG1d3DZTxSe', 'tTJfgtdukweQE8CgfnF', 'cM23bAdxoF512v5GYph', 'MWmxkkdc2ljstBYdFqI'
Source: 0.2.NRKCZ1PSDM.exe.3df9550.0.raw.unpack, WS36uhldRk15BMqR9l.cs High entropy of concatenated method names: 'WafGmnTa34nDiqJLIUu', 'sNkakTTqkS3CcudO9wQ', 'tWmg2rjfPX', 'rQ7XTBTG9J2qD190dlr', 'fHWlxHTOrZ80BKuh86A', 'WiRsW5T4Jm2UFiKVXmh', 'Y3sBLUTtw3jwZSiZsYl', 'nW4lBacjpc', 'BRLsfrdFc8', 'tHFsgjAiBB'

Boot Survival

barindex
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Jump to behavior

Hooking and other Techniques for Hiding and Protection

barindex
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process created: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\NRKCZ1PSDM.exe" & rd /s /q "C:\ProgramData\djecj" & exit
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process created: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\NRKCZ1PSDM.exe" & rd /s /q "C:\ProgramData\djecj" & exit Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0040E886 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 2_2_0040E886
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Memory allocated: 1010000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Memory allocated: 2DF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Memory allocated: 1190000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Evasive API call chain: GetSystemTime,DecisionNodes
Source: C:\Windows\SysWOW64\timeout.exe TID: 8984 Thread sleep count: 88 > 30
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00413C71 SHGetFolderPathA,wsprintfA,FindFirstFileA,FindNextFileA,strcpy,_splitpath,strcpy,strlen,isupper,wsprintfA,strcpy,strlen,SHFileOperationA,FindNextFileA,FindNextFileA,FindClose, 2_2_00413C71
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_004112E8 wsprintfA,FindFirstFileA,memset,memset,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,SymMatchString,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 2_2_004112E8
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00407891 FindFirstFileA,CopyFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,FindNextFileA,FindClose, 2_2_00407891
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0040A69C FindFirstFileA,StrCmpCA,CopyFileA,Sleep,DeleteFileA,FindNextFileA,FindClose, 2_2_0040A69C
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00408776 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 2_2_00408776
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00411D33 wsprintfA,FindFirstFileA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 2_2_00411D33
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_004013DA FindFirstFileA,FindNextFileA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindNextFileA,FindClose, 2_2_004013DA
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00406784 ExpandEnvironmentStringsA,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,StrCmpCA,CopyFileA,CopyFileA,Sleep,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 2_2_00406784
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00412BBE wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 2_2_00412BBE
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00409C78 wsprintfA,FindFirstFileA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 2_2_00409C78
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00408224 FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 2_2_00408224
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0041269A GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 2_2_0041269A
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00411883 SymMatchString,SymMatchString,SymMatchString,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 2_2_00411883
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0040DF8C GetSystemInfo,wsprintfA, 2_2_0040DF8C
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: chrome.exe, 00000008.00000002.2316751639.00003FF000290000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=5e519c05-bcea-42f2-9bdc-ce376c32c155
Source: Amcache.hve.6.dr Binary or memory string: VMware
Source: Web Data.13.dr Binary or memory string: discord.comVMware20,11696487552f
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWQe
Source: Amcache.hve.6.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Web Data.13.dr Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp, NRKCZ1PSDM.exe, 00000002.00000002.2638887572.00000000010C8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Web Data.13.dr Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Web Data.13.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.13.dr Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.13.dr Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Amcache.hve.6.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Web Data.13.dr Binary or memory string: AMC password management pageVMware20,11696487552
Source: Web Data.13.dr Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.13.dr Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.13.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Amcache.hve.6.dr Binary or memory string: vmci.sys
Source: Web Data.13.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Web Data.13.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.13.dr Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Amcache.hve.6.dr Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: chrome.exe, 00000008.00000002.2316751639.00003FF000290000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=5e519c05-bcea-42f2-9bdc-ce376c32c155J
Source: Amcache.hve.6.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Web Data.13.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Web Data.13.dr Binary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
Source: Web Data.13.dr Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Amcache.hve.6.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr Binary or memory string: VMware, Inc.
Source: Web Data.13.dr Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Amcache.hve.6.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.6.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: msedge.exe, 0000000C.00000003.2363678175.00005BDC002C0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware20,1(
Source: Web Data.13.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Amcache.hve.6.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Web Data.13.dr Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: msedge.exe, 0000000C.00000002.2449252822.0000018179E43000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.13.dr Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Amcache.hve.6.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Web Data.13.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.13.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.13.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: Web Data.13.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.13.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Amcache.hve.6.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Web Data.13.dr Binary or memory string: outlook.office.comVMware20,11696487552s
Source: chrome.exe, 00000008.00000002.2311248011.000002C250377000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlljj9IP
Source: Web Data.13.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.13.dr Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.13.dr Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: Web Data.13.dr Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.13.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0040E886 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 2_2_0040E886
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 0_2_02DFE481 mov edi, dword ptr fs:[00000030h] 0_2_02DFE481
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 0_2_02DFE5FE mov edi, dword ptr fs:[00000030h] 0_2_02DFE5FE
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0040D84A lstrlenA,GetProcessHeap,RtlAllocateHeap,lstrcpyA,lstrcatA, 2_2_0040D84A
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Source: Yara match File source: Process Memory Space: NRKCZ1PSDM.exe PID: 6540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: NRKCZ1PSDM.exe PID: 6536, type: MEMORYSTR
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 0_2_02DFE481 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread, 0_2_02DFE481
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Memory written: C:\Users\user\Desktop\NRKCZ1PSDM.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0040F029 CreateToolhelp32Snapshot,Process32First,StrCmpCA,Process32Next,StrCmpCA,CloseHandle, 2_2_0040F029
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0040F0CA CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle, 2_2_0040F0CA
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process created: C:\Users\user\Desktop\NRKCZ1PSDM.exe "C:\Users\user\Desktop\NRKCZ1PSDM.exe" Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\NRKCZ1PSDM.exe" & rd /s /q "C:\ProgramData\djecj" & exit Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 2_2_0040DE1C
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Queries volume information: C:\Users\user\Desktop\NRKCZ1PSDM.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00417652 SetFilePointer,SetFilePointer,GetLocalTime,SystemTimeToFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z, 2_2_00417652
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_00414E31 EntryPoint,GetUserNameW,GetComputerNameW, 2_2_00414E31
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Code function: 2_2_0040DDBF GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA, 2_2_0040DDBF
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: Amcache.hve.6.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

barindex
Source: Yara match File source: NRKCZ1PSDM.exe, type: SAMPLE
Source: Yara match File source: 0.0.NRKCZ1PSDM.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.NRKCZ1PSDM.exe.3df9550.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.NRKCZ1PSDM.exe.3df9550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.2108384466.00000000007A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2162926184.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 2.2.NRKCZ1PSDM.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.NRKCZ1PSDM.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.NRKCZ1PSDM.exe.3df9550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.2637808939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2162926184.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: NRKCZ1PSDM.exe PID: 6540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: NRKCZ1PSDM.exe PID: 6536, type: MEMORYSTR
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Electrum-LTC\wallets\
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \ElectronCash\wallets\
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Electrum\wallets\
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: exodus.conf.json
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Exodus\exodus.wallet\
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: info.seco
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ElectrumLTC
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: passphrase.json
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Ethereum\
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Exodus
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Ethereum\
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Exodus\exodus.wallet\
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: multidoge.wallet
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: seed.seco
Source: NRKCZ1PSDM.exe, 00000000.00000000.2108384466.00000000007A2000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: set_UseMachineKeyStore
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Electrum-LTC\wallets\
Source: NRKCZ1PSDM.exe, 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\*.*m
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\events\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\db\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\security_state\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\bookmarkbackups\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\to-be-removed\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\minidumps\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\key4.db Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Exodus\backups\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Source: Yara match File source: 00000002.00000002.2638887572.000000000113F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: NRKCZ1PSDM.exe PID: 6536, type: MEMORYSTR

Remote Access Functionality

barindex
Source: C:\Users\user\Desktop\NRKCZ1PSDM.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: Yara match File source: NRKCZ1PSDM.exe, type: SAMPLE
Source: Yara match File source: 0.0.NRKCZ1PSDM.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.NRKCZ1PSDM.exe.3df9550.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.NRKCZ1PSDM.exe.3df9550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.2108384466.00000000007A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2162926184.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 2.2.NRKCZ1PSDM.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.NRKCZ1PSDM.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.NRKCZ1PSDM.exe.3df9550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.2637808939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2162926184.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: NRKCZ1PSDM.exe PID: 6540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: NRKCZ1PSDM.exe PID: 6536, type: MEMORYSTR
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs