Configure Windows 10 to create Dump Files on Blue Screen of Death
If your Windows PC encounters an error, it will display a Blue Screen of Death or BSOD error which usually comes up for a fraction of second and creates some logs or Dumps Files as what other user prefers to call it and then boots your PC suddenly. This process usually takes place quickly that most users find it hard to get the error code and won’t probably be able to check what really went wrong with their PCs. This is where the dump files come in. They are stored internally in your computer and can only be accessed by an administrator. They are classified into 4 main types and in Windows 10 they are either:
Complete Memory Dump
Kernel Memory Dump
Small Memory Dump (256 KB)
Active Memory Dumps
Dump Files are useful as they could help you in resolving the problem and so you need to configure your Windows 10 PC to create them but first, you need to make a system restore point. This is essential as you are about to modify some system files as well as critical Windows 10 settings. There are two ways you can create Dump files – first is by modifying the settings in the Startup and Recovery and lastly is via the WMIC command line. Refer to the instructions prepared below to be guided on how you can create Dump files after any BSOD error using these options.
Option 1 – via Startup and Recovery
Type in “control panel” in the Cortana Search box and then click on Control Panel from the search results to open it.
After opening Control Panel, you need to make sure that you view the contents by their Category then click on the header link which is labeled “System and Security” or you could also right-click on the This PC icon and then click on Properties.
Next, select the Advanced system settings from the left panel. Once you do, a new and small window will pop up.
Under the newly opened window, look for the section called Startup and Recovery and then click on the Settings button.
And from the System Failure section, you can choose any option from the drop-down for Write debugging information such as:
None – this means that there is no dump file created by Windows
Small Memory Dump – this means that Windows will create a Minidump file on BSOD
Complete Memory Dump – this means that Windows will create a Complete Memory Dump file on BSOD
Automatic Memory Dump – this means that Windows will create an Automatic Memory Dump file on BSOD
Active Memory Dump – this means that Windows will create an Active Memory Dump file on BSOD
Note: The complete dump needs a page file that is allowed to be the size of the physical memory installed in your PC with a dedicated 1 MB of space for just the page header.
Now once you have selected the most suitable option for you, just click on OK/Apply and then exit.
Restart your PC to successfully apply the changes made.
Option 2 – via the WMIC command line
The first thing you need to do to create Dump files via the WMIC command line is to tap the Win + X keys combination or simply right-click on the Start button and then select the Command Prompt (Admin) option. You could also type in “cmd” in the Cortana search box and then right-click on Command Prompt from the results and select Run as administrator.
After that, type in any of the commands given below depending on your preferences so that your Windows 10 PC will be configured to create Dump Files:
No dump file: wmic RECOVEROS set DebugInfoType = 0
Small Memory Dump: wmic RECOVEROS set DebugInfoType = 3
Kernel Memory Dump: wmic RECOVEROS set DebugInfoType = 2
Complete Memory Dump: wmic RECOVEROS set DebugInfoType = 1
Automatic Memory Dump: wmic RECOVEROS set DebugInfoType = 7
Active Memory Dump: wmic RECOVEROS set DebugInfoType = 1
Note: A complete dump has to have a Page file which is allowed to be the size of the physical memory installed on your PC accompanied by a 1 MB space for just the page header.
Now type in “exit” in the Command Prompt to exit it.
Restart your PC to apply the changes made successfully.
The Error Code 0xC1900208 – 0x4000C is an error that is caused by an installed application or program on your computer that is not compatible with Microsoft Windows 10. The incompatible application prevents you from being able to complete the upgrade to Microsoft Windows 10 and will continue to do so until the issue is resolved.
Common symptoms include:
You receive a dialog box displaying Error Code 0xC1900208 – 0x4000C
You are unable to successfully complete the Microsoft Windows 10 upgrade process.
Solution
Error Causes
Error Code 0xC1900208 – 0x4000C is caused by a non-compatible application or program that is currently installed on your computer, and is not allowing the Microsoft Windows 10 upgrade to finish the installation and update process.
The upgrade is stopped due to an incompatible app or program.
Out of date or no longer supported software can cause this error to occur.
Device drivers that are not up to date or no longer compatible.
The computer might pick up malware along the way and might be preventing the upgrade. If error code 0xC1900208 – 0x4000C is not rectified, you’ll not be able to proceed with your Windows 10 upgrade.
Further Information and Manual Repair
The good news is, error code 0xC1900208 – 0x4000C is a relatively common problem that is usually easily fixed by the user at home, though it can be a little time-consuming. To elude this time-consuming process, use a powerful tool to rectify the issue in no time (TSC). Before making any attempts to repair this error, ensure to perform a compatibility test.
Check the compatibility of applications and programs installed on your computer to locate and remove, or fix the one that is incompatible. (Don't stop at the first one you find, there could be multiple incompatibility issues.)
Check to ensure all programs and software are not outdated or no longer supported, and remove or fix any outdated or unused, unnecessary programs or software. (This is also a great way to free up space and clean your computer up a bit.)
Check to ensure that all of your device drivers are current, up to date, and compatible with Microsoft Windows 10, and replace or update where necessary.
Method 1:
Use the get Microsoft Windows 10 application on your computer to check its compatibility, follow the steps below to run the check.
Look at the taskbar, to the right; you will see an icon for Microsoft Windows 10, right-click the icon. Locate the option in the menu to check the status of your upgrade. This will open an app for getting Microsoft Windows 10.
Next, you will see 3 lines on top of one another on the upper left side, this will open a drop-down menu, once you have this menu open, locate the option to check the compatibility of your computer.
Microsoft Windows will then run a check of your entire computer to check for compatibility with Microsoft Windows 10. Once it has finished its check, a pop-up window will display whether or not your computer will work with Microsoft Windows 10, and will also display a list of any hardware and software that are not compatible with the upgrade.
This may not catch everything and there may still be incompatible programs so the previous steps, though time-consuming may still be necessary.
Method 2:
Once the incompatible applications are discovered, use the control panel to remove/uninstall them. The steps are below:
Locate your computer’s Control Panel.
Choose the option that says “Programs”
From the options available, select the ‘Programs and Features’ link.
Locate the app in the queue or menu.
Right-click and choose the uninstall option.
… another option
You can also locate the app on the ‘app homepage’, right-click and choose the ‘uninstall’ option. If after following these steps the problem is still not corrected, download and install an automated tool for a quick fix.
When you get an igfxem.exe error in Windows, it is not really clear what does this means, usually, Windows throw us some code or we get a DLL error, rarely we get an EXE error. So what does this error means?
Intel Graphics Executable Main Module, shortly called as IgfxEM module is a part of the Windows operating system. When you run Microsoft .NET Framework applications that use the AS/400 Data Queue ActiveX control (Mseigdq.dll) to read from and to write to IBM iSeries (AS/400) data queues, you may experience this error.
In order to overcome this error and cope with it try the following things:
Increase Virtual Memory
Go to the Start Menu and click on Settings.
Type performance.
Choose Adjust the appearance and performance of Windows.
In the new window, go to the Advanced tab and under the Virtual memory section, click on Change.
At the bottom of the new window, check what the Recommended value is and how it compares to Currently allocated.
If the current setting is significantly less than the recommended, uncheck the Automatically manage paging file size for all drives box at the top of the same windows and then click on Custom size.
Enter the Recommended value in the Initial Size box, and a larger figure in the Maximum size box.
Click OK to save the new settings.
Download and update .NET framework
Go to the Microsoft website and download the latest .NET framework. Once the download is complete, install the package following onscreen instructions.
Reinstall INTEL graphic drivers
Go to the intel website and download the latest graphic drivers for your graphic card model. Once the download is complete, install the package following onscreen instructions.
Run SCF scan
If all else fails, run command prompt and inside type sfc /scannow
Windows 11 has been officially presented during Microsoft’s virtual event on June 24th.
Since presentation internet has been pretty live and busy with a discussion about it, some discussions are positive, some not so much but that is expected and it happens always when a new product is presented.
One of information that we have about Windows 11 is tied to the home edition of this OS,
Windows 11 home edition will require an internet connection at setup, and a Microsoft account in order to be installed and used. Previous versions of Windows could be installed and used with local accounts but it seems Microsoft has abandoned that idea for its new OS.
OS will be delivered mostly as updates or via internet download so internet and online requirement make sense but why it cannot use the local account and must have a Microsoft one is beyond me.
The store is not downloading Apps: As you know, the Windows Store is one of the places where you can download Windows apps. However, there are times when you might not be able to do so for some reason. For instance, if you search for an app and click on the get it now button, instead of downloading the app, nothing happens and there are also cases when the download will start but the page will refresh after half a second. When this issue happens, you won’t be seeing any error message or warning at all. So you’ll just have to look at the download get started where the page will refresh and you’ll be back at the Get button.
This issue in the Windows 10 Store only happens for a few apps so even though you are able to download some apps, you might be able to do on other ones. Note that the apps affected are random and there is no specific set of apps that cause this issue while downloading and that this problem will repeat again each time you click on the Get it now button. This issue is definitely caused by Windows itself and has something to do with a bug in the Windows store which was brought by the latest Windows Update. It’s already a known issue among other Windows 10 users who are also suffering the same dilemma. So until Microsoft releases another update to fix this bug, you will have no choice but to deal with it in the meantime. On the other hand, you can also try a couple of suggestions laid out in this post. Follow the steps in every option given below to fix the issue with the Windows 10 Store.
Option 1 – Try signing out from the Microsoft Store
A lot of Windows 10 users were able to resolve the problem by simply signing out and signing back into the Microsoft Store. How? Follow these steps:
Go to the Microsoft Store.
Next, go to the Get page of the app you were trying to download.
And then click on your account picture located in the top right corner of the window and select your account.
Sign out from your account and after that, click the Get button to download the app.
After that, a new window will appear where you’ll have to select your account and click on Continue.
Now enter your credentials. Once you do, the app should be downloaded automatically after you’re signed in. And that’s about it.
Note: Keep in mind that this option is merely a temporary solution to the problem and once you close the Microsoft Store and open it back again, you will be back to square one.
Option 2 – Wait for the Windows Update
As mentioned, this is already a known issue and a lot of Windows 10 users have already complained about it to Microsoft so a bug fix will be soon released in the latest Windows Updates.
Error 101 is a Google Chrome error. You may experience this error if you browse the internet using Google Chrome. This error results when the existing HTTP connection between Chrome and the website is broken.
The error is displayed in the following format: “Error 101 (net::ERR_CONNECTION_RESET): The connection was reset.”
Solution
Error Causes
The cause of Google Chrome error 101 cannot be narrowed down. This error can be triggered on your PC due to multiple reasons. These include:
The inability of the Google Chrome installer to create a temporary directory on your PC during the installation process
Enabled DNS Prefetching
Firewall
Viral Infection
Bad Registry Entries
Poor Internet Connection
Though this error code is not fatal, nonetheless it is advisable to fix it to ensure you are able to browse the internet using Google Chrome.
Further Information and Manual Repair
The good news is that this error is quite easy to resolve. Even if you are not a technical whiz you can still manage to fix it by trying these easy and effective DIY methods we have listed below:
Method 1: Reload the Website link on Chrome or Check Your Internet Connection
Sometimes refreshing the webpage can resolve the issue easily. Try doing it. Reload the link by pressing Ctrl +R. This will refresh the webpage.
If it starts working then that’s great but if it doesn’t then it is advisable to check your internet connection. Disable and Enable the connection and then try browsing on Chrome again. If websites are accessible then the problem is resolved.
If the error persists then try other methods.
Method 2: Disable DNS Pre-fetching
Sometimes this error may occur due to enabled DNS pre-fetching. To resolve the issue, open Chrome, then click on the wrench key. Go to setting and under the bonnet and Privacy section, look for the DNS perfecting option.
If it is enabled, then uncheck it to disable DNS Pre-fetching. Save the changes and then close the browser. Now open it again and try browsing on Chrome. If error 101 does not appear and you are able to access websites then the issue is fixed.
Method 3: Scan for Viruses
Another way to fix this is to download and run a powerful antivirus. Scan and remove viruses to fix the problem.
Method 4: Check the permission for your temporary folder
As mentioned above, another underlying reason for error 101 can be Google Chrome installer was unable to create a temporary directory on your system during the installation process.
To resolve it, check the permission for your temporary folder. Here’s how to do it: First go to the start menu and type Run. Now enter one of the following directories in the text fields
1. Windows XP: %USERPROFILE%Local Settings
2. Windows Vista: %USERPROFILE%AppDataLocal
After that press OK. This will open a new window. In the Window that opens, right-click the temp folder. Now select properties and press the security tab to continue. In the group and user names section, select your user profile name.
In the permissions, section verify that the checkboxes for READ, WRITE, and READ & EXECUTE permissions in the DENY column are not selected. After you have verified, click apply and then ok. Now try reinstalling the Google Chrome browser again on your system.
Method 5: Remove Bad Entries by Cleaning the Registry
Bad entries and cookies saved in the registry can also lead to error 101. You can remove them manually but that will take a great deal of time and can be slightly difficult if you are not technically sound.
Therefore, it is advisable to download Restoro. This is a user-friendly PC Fixer integrated with a registry cleaner that scans and removes all registry issues in a few clicks. It removes all the bad entries and junk files cluttering the registry and repairs it instantly.
Click here to download Restoro.
The Local Security Authority Subsystem Service or LSASS.exe is a process in the Windows operating system that is valuable as it enforces the security policy on the computer. Every time you log in to the Windows Server, the LSASS.exe is the one that handles the password changes and creates the access tokens while updating the security log. However, it is also frequently targeted by malware and is often imitated. The original location of this file is at “C:/Windows/System32” so if you open the Task Manager and notice that a process with a similar name has a different location then it is definitely a threat and is exploiting the security of your computer.
To resolve issues related to LSASS.exe, here are some fixes that could help.
Option 1 – Use the Performance Monitor’s Active Directory Data Collector
Note that this option will only work on the recent Windows server versions. Refer to the steps below to use the Performance Monitor’s Active Directory Data Collector set on your computer.
Tap the WINKEY + R button to open the Run dialog box.
Then type “Perfmon.msc” in the field and hit Enter to open the Performance Monitor and from there open the Server Manager.
Next, navigate to Diagnostics > Reliability and Performance > Data Collector Sets > System from the left side of the navigation bar.
Then right-click on “Active Directory Diagnostics” and select Start from the context menu. This will take about 5 minutes or 300 seconds depending on the performance capabilities of your hardware to gather the data required and then take some more time to compile a report from the gathered data. Note that these timings are dependent on one another.
After the report is compiled, you can find it under Diagnostics > Reliability and Performance > Reports > System > Active Directory Diagnostics. The report will contain all the information as well as conclusions. However, it does not mean that it will also contain the exact cause of the problem with LSASS.exe. Nevertheless, it should help you in fixing the problem.
Option 2 – Try to run the System File Checker
System File Checker or SFC is a built-in command utility that helps in restoring corrupted files as well as missing files. It replaces bad and corrupted system files to good system files that might be the cause why the LSASS.exe file is having some issues. To run the SFC command, follow the steps given below.
Type “cmd” in the Start search and then right-click on the appropriate search result.
Next, select “Run as administrator” to open Command Prompt with admin privileges.
After opening Command Prompt, type in sfc /scannow
The command will start a system scan which will take a few whiles before it finishes. Once it’s done, you could get the following results:
Windows Resource Protection did not find any integrity violations.
Windows Resource Protection found corrupt files and successfully repaired them.
Windows Resource Protection found corrupt files but was unable to fix some of them.
Now restart your computer and see if the problem is fixed or not.
Option 3 – Put your computer in a Clean Boot State
If none of the options given above helped, you can try putting your computer in a Clean Boot State as this can help you in finding any incompatible programs that’s causing the problem.
Log onto your PC as an administrator.
Type in MSConfig in the Start Search to open the System Configuration utility.
From there, go to the General tab and click “Selective startup”.
Clear the “Load Startup items” check box and make sure that the “Load System Services” and “Use Original boot configuration” options are checked.
Next, click the Services tab and select the “Hide All Microsoft Services” check box.
Click Disable all.
Click on Apply/OK and restart your PC. (This will put your PC into a Clean Boot State. And configure Windows to use the usual startup, just simply undo the changes.)
From there, start to isolate the problem by checking which one of the programs you installed recently is the root cause of the problem.
Once you’ve found any incompatible programs, you need to uninstall them. Refer to the steps below to do so.
In the search box, type in “control” and then click on Control Panel (desktop app) among the search results.
After that, select Programs and Features from the list which will give you a list of all the programs installed on your computer.
From there, look for the concerned program and select it and then uninstall it.
Note: If you have downloaded the app from the Windows Store, you can simply right-click on it from the application list and then uninstall it.
In the latest Windows 11 fiasco, it is reported that the operating system is slowing down some SSD drives. Good thing is that it does not affect all of SSD on the market but the ones which it is affecting can see even a 45% of speed drop.
Microsoft has not published a solution to this issue, but users point out two potential problems. The first is a security mechanism based on disk virtualization, which is supposed to slow down the performance of SSDs.
The second, in turn, is related to the place of installation of Windows 11 – users indicate that if the performance test is performed on a medium with no files associated with the system, its performance results are similar to the parameters given by the manufacturer.
Transfer speeds were to be slightly improved with the latest Windows 11 update 22000.348. However, users are still waiting for a solution to the problem that significantly reduces the efficiency of SSD media.
More information
The details described leading to speculation that the problem could be related to drivers that Microsoft is providing. On further tests, all Nvme drives that use the Microsoft driver have this problem, but Intel 905P, which has its own driver provided by Intel, is working at full power,”.
Hello and welcome to our software series review. Weel this time we could say this is more of a service review since the application we are going through today is online and you can use it freely without ever needing to install it.
When we choose software that we are going to review and recommend we really try to recommend something that is worth your time and money, Cartoonize fits in both categories in my opinion.
First of all basic plan of this graphic software is completely free and as mentioned it is working online, also as one more feature basic plan does not even require you to have an account of any kind, all you need to do is go to the website of the application and you can start using it right away. There is also paid plan for extra features if you need them billed monthly or annually.
Features
First things first, this is not Photoshop or GIMP and it does not aim nor want to be. This is something else, directed and pointed at the different types of users. This application is aimed at people that want to make some quick graphics and post them on social media and it does that very well. Even without knowledge to use graphic software this one is so well designed and straightforward that even a complete newcomer can do something right away.
So as the application that wants to be used by people that want to place some cool pictures or ads on their social media what it offers. For starters simplicity and ease of use, every option that you can use is on the left side of the screen nicely packed into the vertical toolbox. Inside the toolbox, you have access to various tools, effects, and filters that you can apply to your image.
Tools explained
Image manager
The first section on the tool panel is the image manager, here you can upload your images, delete them, search stock images, and so forth. nothing more to say about this one as it is only a basic file manager.
Edit
In this tool panel, there are a lot of basic settings for your image manipulations divided into 3 sections: Basics, Enhance, and Creative. In the basic section, you can crop, resize and rotate your image. Enhance panel will let you set exposure, color, vibrance, tint, and details (sharpen). Finally, the Creative part will let you remove the background with AI in a single click, replace colors in the image, and add a vignette and round image.
Effects
In the effects panel, you will be given 4 options to choose from Cartoonizer, Digital art, Sketcher, and painting. Each option once clicked will open another set of options tied to chosen preset where you will be able to choose a different style from chosen template. Once you click on the desired template it will be applied to your image and in the upright corner, you will have edit options to tweak it to your liking. You can play around as much as you want because only once you click on the apply button, the effect will be applied to your image.
Filters
Same as in the effects tool panel here you will also get a series of different filters that you can apply to your image. As in the previous tool once clicked on the chosen filter, you will be given options for its variations and details edits. How there is really plenty of filters options and combined with its own presets I will not focus on explaining what each one is doing since picture thumbnails are pretty accurate and just one look at them will explain to you everything you need to know.
Overlays
In the overlays panel, you can as the name says overlay different kinds of effects on your image. You can add snow, fog, sun flares rain, and many more. Presets work identically to previous effects and filters.
Masks
If you want to place your image in a certain shape or in-text this is the section for you. You will be presented with sections as custom text, shapes, brushes, floral, animals, and patterns. Each section will once again lead to plenty of variations on the chosen subject where you can pick one that you like the most and tweak its options.
Text
As the name suggests, this section is to add text to your picture or design. If you are making some cool ad for Facebook, Instagram, or other social media I believe that you will spend most of your time in this section adding text and tweaking it so it looks best. You have all the tools that you will need to make a catchy title or smaller block of text and you can add multiple texts to your picture tweaking their own visual appearance, the font used, color, and some effects like a drop shadow.
Draw
In the draw section, you will be able to freely draw whatever you like with your mouse or pen if you have one. you have basic options for a brush and eraser so you can erase stuff. Pretty basic tool but it gives a nice touch to underline something, circle it, etc.
Graphics
This panel will let you place various already made graphic assets into a picture. You have hearts, hats, glasses, etc. There really are tons of premade graphics along with thematic ones like new year, st. Patric day and more.
Frames
As the name suggests this section will place a frame of your choice around your picture. You can choose the style of frame, position, color, and many more. There are various styles and each style has its own options.
Conclusion
Cartoonize is a great online application that will let you quickly and easily do cool and nice image edits. As mentioned you can also add various effects, text, and graphics and use this app to make some quick and nice ads for social media. You have the option to publish to your social media right from the app in the save dialog but you can also of course download your image or design to your local computer.
Please note that for this review we used the pro, paid version so all of the features were unlocked. We wanted to give you a full overview of the full potential of the app. In my opinion, the small monthly fee that they charge is well worth it when you see all things that you can do with it.
Go to the cartoonize website and check it out, basic option is completely free and it does not even require making an account. Have fun, be creative and take care, I hope to see you again tomorrow.
The previous Windows versions all came with Microsoft's browser Internet Explorer. A lot of users love it because not only that it is easy to use. It is also very fast. Users didn’t have to worry about compatibility because it is almost always compatible with its Windows Version.
When they introduced Windows 10, they changed the name of the browser from Internet Explorer to Microsoft Edge. It is faster and more user-friendly compared to its predecessors. But after the Creator Update, some experienced receiving the inet_e_resource_not_found error code.
In contrary to what everyone expects, you actually don’t have to uninstall and reinstall the Microsoft Edge App. What you can do is reset the browser in your Apps & Features Settings in your Microsoft Settings.
To reset the browser you can follow the steps below:
Click on the Windows icon and go to settings.
Click on Apps and this will bring you to the Apps & Features page. Look for Microsoft Edge from the list of Apps and click on it.
Choose Advance Option
Scroll down then Under Reset, click on repair or reset. When you repair it will fix the existing problem but the data that caused the problem may still be present and can still cause problems. If you click on reset, it will delete all the cache and cookies that are installed in your browser but it will save your Favorites as well as your bookmarks.
Another way to resolve this is by disabling the feature TCP Fast Open on Microsoft Edge. To disable this, go ahead and follow the steps below:
Open the Microsoft Edge browser.
Type in about: flags on the Address (URL) bar.
Under Networking, uncheck the Enable TCP Fast Open.
Close your Microsoft Edge browser and open a new one.
Flushing the DNS also worked for other Users. Sometimes, the error code the inet_e_resource_not_found is caused by a corrupted DNS cache. There are 2 ways to flush your DNS. The first option is to use the command prompt to run the command.
To access the Command prompt or CMD, you can search for it on Cortana or you can click on the Windows icon to access the Programs, scroll down to the Windows System folder and click on it.
A drop-down menu will show up, click on Command Prompt which is the first on the list.
Type in the code ipconfig /flushdns and press enter.
There will be a message that will show that says Windows IP configuration successfully flushed the DNS Resolver Cache
Exit the CMD by typing exit and press enter.
The easiest way to do this is to Press the keys Window + R on your keyboard. Type in ipconfig /flushdns in the search box and hit enter or click on OK.
These are only some of the ways to resolve the inet_e_resource_not_found. There are other ways to further troubleshoot this issue such as reinstalling your Wifi Adapter Driver or adjusting the DNS Server Address. But most of the time, users are able to resolve the issue with the steps provided above.
New malware with extensive spyware capabilities steals data from infected Android devices and is designed to automatically trigger whenever new info is read to be exfiltrated. The spyware can only be installed as a 'System Update' app available via third-party Android app stores as it was never available on Google's Play Store. This drastically limits the number of devices it can infect, given that most experienced users will most likely avoid installing it in the first place. The malware also lacks a method to infect other Android devices on its own, adding to its limited spreading capabilities.
However, when it comes to stealing your data, this remote access trojan (RAT) can collect and exfiltrate an extensive array of information to its command-and-control server. Zimperium researchers who spotted it observed it while "stealing data, messages, images and taking control of Android phones."
What happens when malicious software is installed
"Once in control, hackers can record audio and phone calls, take photos, review browser history, access WhatsApp messages, and more," they added. Zimperium said its extensive range of data theft capabilities includes:
Stealing instant messenger messages;
Stealing instant messenger database files (if the root is available);
Inspecting the default browser's bookmarks and searches;
Inspecting the bookmark and search history from Google Chrome, Mozilla Firefox, and Samsung Internet Browser;
Searching for files with specific extensions (including .pdf, .doc, .docx, and .xls, .xlsx);
Inspecting the clipboard data;
Inspecting the content of the notifications;
Recording audio;
Recording phone calls;
Periodically take pictures (either through the front or back cameras);
Listing of the installed applications;
Stealing images and videos;
Monitoring the GPS location;
Stealing SMS messages;
Stealing phone contacts;
Stealing call logs;
Exfiltrating device information (e.g., installed applications, device name, storage stats).
How does it work?
Once installed on an Android device, the malware will send several pieces of info to its Firebase command-and-control (C2) server, including storage stats, the internet connection type, and the presence of various apps such as WhatsApp. The spyware harvests data directly if it has root access or will use Accessibility Services after tricking the victims into enabling the feature on the compromised device. It will also scan the external storage for any stored or cached data, harvest it, and deliver it to the C2 servers when the user connects to a Wi-Fi network. Unlike other malware designed to steal data, this one will get triggered using Android's contentObserver and Broadcast receivers only when some conditions are met, like the addition of a new contact, new text messages, or new apps being installed.
"Commands received through the Firebase messaging service initiate actions such as recording of audio from the microphone and exfiltration of data such as SMS messages," Zimperium said.
"The Firebase communication is only used to issue the commands, and a dedicated C&C server is used to collect the stolen data by using a POST request."
Camouflage
The malware will also display fake "Searching for the update.." system update notifications when it receives new commands from its masters to camouflage its malicious activity. The spyware also conceals its presence on infected Android devices by hiding the icon from the drawer/menu. To further evade detection, it will only steal thumbnails of videos and images it finds, thus reducing the victims' bandwidth consumption to avoid drawing their attention to the background data exfiltration activity. Unlike other malware that harvests data in bulk, this one will also make sure that it exfiltrates only the most recent data, collecting location data created and photos taken within the last few minutes.
If you would like to read more helpful articles and tips about various software and hardware visit errortools.com daily.