Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
cMqyGFCQHk.exe

Overview

General Information

Sample name:cMqyGFCQHk.exe
renamed because original name is a hash value
Original sample name:3c3f458400c557d279c4d4993f67adc8ba3da4bad8fc844adfef8c7de475a1f7.exe
Analysis ID:1556006
MD5:b408e3da98f0e457d627510165374ddd
SHA1:49de055d881896670ce8b1ba1633d5f8b4f8e193
SHA256:3c3f458400c557d279c4d4993f67adc8ba3da4bad8fc844adfef8c7de475a1f7
Tags:exeLionSoftwareLLCuser-JAMESWT_MHT
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Sigma detected: Powershell create lnk in startup
Drops large PE files
Powershell creates an autostart link
Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Drops PE files
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Electron Application Child Processes
Stores files to the Windows start menu directory
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • cMqyGFCQHk.exe (PID: 6840 cmdline: "C:\Users\user\Desktop\cMqyGFCQHk.exe" MD5: B408E3DA98F0E457D627510165374DDD)
    • cmd.exe (PID: 4508 cmdline: "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Teams.exe" /FO csv | "C:\Windows\system32\find.exe" "Teams.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 2184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • tasklist.exe (PID: 3328 cmdline: tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Teams.exe" /FO csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
      • find.exe (PID: 4040 cmdline: "C:\Windows\system32\find.exe" "Teams.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
  • Teams.exe (PID: 5912 cmdline: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" MD5: 102326801694C938E466C8D96E4200BD)
    • Teams.exe (PID: 6472 cmdline: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1708,i,13854425415668292357,6166449907864565243,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2 MD5: 102326801694C938E466C8D96E4200BD)
    • cmd.exe (PID: 6976 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 5896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 6292 cmdline: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • Teams.exe (PID: 3268 cmdline: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2576,i,13854425415668292357,6166449907864565243,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:3 MD5: 102326801694C938E466C8D96E4200BD)
  • Teams.exe (PID: 1060 cmdline: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" MD5: 102326801694C938E466C8D96E4200BD)
    • cmd.exe (PID: 6412 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 1936 cmdline: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • Teams.exe (PID: 3908 cmdline: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1808,i,11489529828536578193,12839987917968536577,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2 MD5: 102326801694C938E466C8D96E4200BD)
    • Teams.exe (PID: 6644 cmdline: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2424,i,11489529828536578193,12839987917968536577,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3 MD5: 102326801694C938E466C8D96E4200BD)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
Source: File createdAuthor: Christopher Peacock '@securepeacock', SCYTHE: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6292, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk
Sigma detected: Startup Folder File Write
Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6292, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk
Sigma detected: Suspicious Electron Application Child Processes
Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"", CommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" , ParentImage: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe, ParentProcessId: 5912, ParentProcessName: Teams.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"", ProcessId: 6976, ProcessName: cmd.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()", CommandLine: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6976, ParentProcessName: cmd.exe, ProcessCommandLine: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()", ProcessId: 6292, ProcessName: powershell.exe

Persistence and Installation Behavior

barindex
Sigma detected: Powershell create lnk in startup
Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"", CommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" , ParentImage: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe, ParentProcessId: 5912, ParentProcessName: Teams.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"", ProcessId: 6976, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: cMqyGFCQHk.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\8013f783-e1a2-5f53-80da-b1ad483bd59fJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Programs\Teams\LICENSE.electron.txtJump to behavior
Source: cMqyGFCQHk.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: ffmpeg.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2392381415.00000000047BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2390610484.00000000047BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vulkan-1.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2368310453.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2374409262.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2368094273.0000000002D20000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdbGCTL source: cMqyGFCQHk.exe, 00000000.00000003.2390610484.00000000047BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: electron.exe.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2379407887.0000000006973000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vk_swiftshader.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2447177094.00000000047BC000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2375843554.0000000005EF0000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\localesJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpackedJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpacked\node_modulesJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-listJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendorJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resourcesJump to behavior
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: * **Google Hangouts Video**: http://www.youtube.com/watch?v=I9nDOSGfwZg equals www.youtube.com (Youtube)
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.css
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.jpg
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://2x.io)
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/355034686
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096371
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096371expandIntegerPowExpressionsThe
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096454
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096480
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096530
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096539
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096608
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096608allowES3OnFL100Allow
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096643
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096648
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096661
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096758
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644593
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644627
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644627skipVSConstantRegisterZeroIn
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644663
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644715
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644730
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644740
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42260492
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42260591
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42260722
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261226
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261713
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261881
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261882
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261924
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261924allowClearForRobustResourceInitSome
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262239
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262247
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262386
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263031
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263407
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263969
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264008
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264951
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265995
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266019
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266610
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267045
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267082
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267082ProgramGL::postLinkJobImpl
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://blog.izs.me/)
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cldr.unicode.org/index/downloads
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/closure-compiler/wiki/SourceMaps
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/python-gflags/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/smhasher/
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1094869
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/110263
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1144207
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1171371
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1181068
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1181193
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1420130
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1434317
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1456243
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/308366
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/403957
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/550292
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/565179
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/642227
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/642605
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/644669
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/650547
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/672380
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/709351
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/797243
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/809422
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/830046
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/883276
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/927470
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/941620
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://feross.org
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://fresc81.github.io/node-winreg
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://git.linuxtv.org/v4l-utils.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/troygoode/)
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://google.github.io/snappy/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://html4/loose.dtd
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://n8.io/)
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ns.apple.com/HDRGainMap/1.0/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ns.apple.com/pixeldatainfo/1.0/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ns.google.com/photos/1.0/container/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ns.google.com/photos/1.0/container/item/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://opensource.perlig.de/rjsmin/
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://skbug.com/9491
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://source.android.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://source.android.com/compatibility)
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2375843554.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/a/1068308/13216
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://substack.net
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://travis-ci.org/troygoode/node-require-directory)
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://website-archive.mozilla.org/www.mozilla.org/mpl/MPL/NPL/1.1/):
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://wpad/wpad.dat
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://wpad/wpad.dat..
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2375843554.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/legal/guidelinesfor3rdparties.html.
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ecma-international.org/memento/codeofconduct.htm
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.finesse.demon.co.uk/steven/sqrt.html.
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.freedesktop.org/wiki/Software/xdg-user-dirs
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.futurealoof.com)
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.gutenberg.org/ebooks/53).
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3C//DTD
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.linux-usb.org/usb-ids.html
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/MPL/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/NPL/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.apple.com/apsl/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/bsd-license.php
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.pertinentdetail.org/sqrt
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ploscompbiol.org/static/license
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.polymer-project.org
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.portaudio.com
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.softsynth.com
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.webrtc.org
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/watch?v=I9nDOSGfwZg
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://zlib.net/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://%s:%d/.well-known/masque/udp/%s/%d/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://%s:%d/.well-known/masque/udp/%s/%d/Net.QuicStreamFactory.DefaultNetworkMatchNet.QuicSession.
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://android.googlesource.com/platform/external/puffin
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/40096376
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/40096712
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/41488638
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42263273
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42263702
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42264072
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265782
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265877
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266740
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266745
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266748
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266811
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42267098
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/8646
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2379407887.0000000006973000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/upload
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2379407887.0000000006973000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons.gvt2.com/domainreliability/upload
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2379407887.0000000006973000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons2.gvt2.com/domainreliability/upload
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2379407887.0000000006973000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons3.gvt2.com/domainreliability/upload
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2379407887.0000000006973000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons4.gvt2.com/domainreliability/upload
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2379407887.0000000006973000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons5.gvt2.com/domainreliability/upload
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2379407887.0000000006973000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons5.gvt3.com/domainreliability/upload
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bit.ly/3rpDuEX.
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bit.ly/3rpDuEX.Invalid
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.htmlMixed
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.android.clients.google.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.bigcache.googleapis.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.doc-0-0-sj.sj.googleusercontent.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.docs.google.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.drive.google.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.googlesyndication.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.pack.google.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.play.google.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.youtube.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2448284804.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=hr&category=theme81https://myactivity.google.com/myactivity/?u
Source: cMqyGFCQHk.exe, 00000000.00000003.2448461981.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=id&category=theme81https://myactivity.google.com/myactivity/?u
Source: cMqyGFCQHk.exe, 00000000.00000003.2449217643.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=lt&category=theme81https://myactivity.google.com/myactivity/?u
Source: cMqyGFCQHk.exe, 00000000.00000003.2450196344.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=nl&category=theme81https://myactivity.google.com/myactivity/?u
Source: cMqyGFCQHk.exe, 00000000.00000003.2450380398.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=pl&category=theme81https://myactivity.google.com/myactivity/?u
Source: cMqyGFCQHk.exe, 00000000.00000003.2450504066.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=pt-BR&category=theme81https://myactivity.google.com/myactivity
Source: cMqyGFCQHk.exe, 00000000.00000003.2450196344.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448461981.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450504066.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450088927.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448658210.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449882670.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: cMqyGFCQHk.exe, 00000000.00000003.2448284804.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450196344.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448461981.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450504066.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450088927.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448658210.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449882670.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: cMqyGFCQHk.exe, 00000000.00000003.2448284804.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450196344.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448461981.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450504066.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450088927.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448658210.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449882670.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: cMqyGFCQHk.exe, 00000000.00000003.2448284804.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450196344.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448461981.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450504066.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450088927.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448658210.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449882670.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: cMqyGFCQHk.exe, 00000000.00000003.2448284804.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450196344.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448461981.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450504066.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450088927.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448658210.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449882670.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: cMqyGFCQHk.exe, 00000000.00000003.2448284804.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450196344.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448461981.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450504066.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450088927.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448658210.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449882670.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromestatus.com/feature/5105856067141632.
Source: cMqyGFCQHk.exe, 00000000.00000003.2448284804.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450196344.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449217643.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450380398.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449380697.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450088927.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448748666.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448658210.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448359715.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449000858.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2379407887.0000000006973000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/external/github.com/intel/tinycbor.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/vulkan-deps/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/webm/libwebm
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/webm/libwebp
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2379407887.0000000006973000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/domainreliability/upload
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://code.google.com/p/v8/wiki/JavaScriptStackTraceApi
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1038223.
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1042393
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1046462
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1060012
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1091824
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1137851
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1154140
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1300575
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1356053
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/40279678
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/40488750
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/593024
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/593024selectViewInGeometryShaderThe
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/650547
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/650547callClearTwiceUsing
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/655534
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/655534useSystemMemoryForConstantBuffersCopying
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/705865
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/710443
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/811661
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/848952
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/927119
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/927119Blink.Script.SchedulingTypeScriptLoader
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/981419
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://creativecommons.org/licenses/by/3.0/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.chrome.com/blog/enabling-shared-array-buffer/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.chrome.com/docs/extensions/mv3/cross-origin-isolation/.
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/includes
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/startsWith
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/android/guides/setup
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/d/17aTgLnjMXIrfjgNaTUnHQO7m3xgzHR2VXBTmi03Qii4/
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://domenic.me/)
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://feross.org
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://feross.org/opensource
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://feross.org/support
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gcp.gvt2.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gcp.gvt6.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Cyan4973/xxHash
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/GoogleChrome/web-vitals
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/GoogleChromeLabs/text-fragments-polyfill
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/Vulkan-Headers
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/Vulkan-Loader
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Maratyszcza/pthreadpool
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Nicoshev/rapidhash
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Nicoshev/rapidhash/blob/master/rapidhash.h
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/PortAudio/portaudio/tree/master/src/common
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ReactiveX/rxjs
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/RyanZim/universalify#readme
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/RyanZim/universalify.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/STRML/async-limiter
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Sebmaster/tr46.js#readme
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Sebmaster/tr46.js.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/SeleniumHQ/selenium/tree/trunk
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Squirrel/Squirrel.Mac
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/TooTallNate/util-deprecate
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/TroyGoode)
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.border-boxcontent-bo
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/scheduling-apis
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/shared-element-transitions/blob/main/debugging_overflow_on_images.md.
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/view-transitions/blob/main/debugging_overflow_on_images.md
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WebAssembly/wasm-c-api/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/aawc/unrar.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/brailcom/speechd
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/brycebaril/node-stream-meter.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/calvinmetcalf/process-nextick-args
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/calvinmetcalf/process-nextick-args.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/wrap-ansi?sponsor=1
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/conventional-changelog/standard-version):
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/dominictarr/rc.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/dpranke/typ.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/etingof/pyasn1
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/zstd
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/queue-microtask
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/run-parallel
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/safe-buffer
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/simple-concat
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/simple-get
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/flutter/flutter/issues/47164
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/flutter/flutter/issues/47804
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/fresc81/node-winreg
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/diff-match-patch/tree/master/javascript
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/distributed_point_functions
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/google-api-cpp-client/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/pprof/tree/master/proto
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/private-join-and-compute
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/protobuf
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/re2
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/ruy
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/securemessage
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/sentencepiece
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/shell-encryption
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/ukey2
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/wicked-good-xpath
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/woff2
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/wuffs-mirror-release-c
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/xnnpack
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/gpuweb/gpuweb/wiki/Implementation-Status#implementation-status
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/gpuweb/gpuweb/wiki/Implementation-Status#implementation-statusFailed
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-core-module
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-core-module.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/node-supports-preserve-symlinks-flag#readme
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/node-supports-preserve-symlinks-flag.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/intel/libva
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/101)
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/102)
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/105)
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/106
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/99)
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/labels/wg-agenda
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068737927
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068738228
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068738548
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068742592
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639071916
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639072106
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639072371
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639072571
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert)
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyent/node
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jprichardson/node-fs-extra
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jprichardson/node-fs-extra/issues/269
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jrmuizel/qcms/tree/v4
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/lgeiger/node-abi/issues/54
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/libuv/libuv/pull/1088
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb)
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2375843554.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2375843554.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/pump
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-fs
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-fs.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-stream
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-stream.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mcollina/reusify#readme
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mcollina/reusify.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/micromatch/to-regex-range
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mikeal/tunnel-agent
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/TSC/blob/master/Moderation-Policy.md
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/blob/master/CODE_OF_CONDUCT.md
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/blob/v10.8.0/lib/internal/errors.js
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/8871#issuecomment-250915913
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/8987
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/35407#issuecomment-700693439
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/string_decoder
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/normalize/mz
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/cli/blob/4c65cd952bc8627811735bea76b9b110cc4fc80e/lib/utils/ansi-trim.js
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-semver.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-tar/blob/51b6627a1f357d2eb433e7378e5f05e83b7aa6cd/lib/header.js#L349
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/wrappy
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/patrickhulce/third-party-web
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/prebuild/prebuild-install
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/prebuild/prebuild-install.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/protocolbuffers/protobuf-javascript
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/protocolbuffers/protobuf/blob/master/java/lite.md
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/puppeteer/puppeteer/tree/main/packages/puppeteer-core
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sass/node-sass/issues/1589#issuecomment-265292579
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/simplejson/simplejson
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/make-dir
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/os-homedir/blob/11e089f4754db38bb535e5a8416320c4446e8cfd/index.js
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/broofa
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/ctavan
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/feross
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/ljharb
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/models
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/tensorflow
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/text.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/tflite-support
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/test262-utils/test262-harness-py
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/troygoode/node-require-directory/
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/uuidjs/uuid.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/v8/v8/blob/6.0.122/test/mjsunit/fast-prototype.js#L48-L63
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068735040
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068735307
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068735697
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068736093
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068736404
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638965835
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638965968
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638966056
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638966247
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638966552
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615021
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615173
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615423
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615557
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615807
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/888438143
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/888438190
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/888438236
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/918633749
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/releases/download/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4805
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4805Custom
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/gamepad/pull/120
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/gamepad/pull/120Access
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-featuresDeviceOri
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/wasdk/wasmparser
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws/issues/1202
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws/issues/1869.
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws/issues/1940.
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/xiph/rnnoise
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/y18n
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs#supported-nodejs-versions
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs-parser#supported-nodejs-versions
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs-parser.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/zeux/volk
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/zorkow/speech-rule-user
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gitlab.freedesktop.org/xorg/proto/xproto/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/7K7WLu
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/7K7WLuThe
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/7K7WLuWebAudio.AutoplayWebAudio.Autoplay.CrossOriginWebAudio.Autoplay.UnlockType..
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/LdLk22
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/LdLk22Media
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/LdLk22RemoveElementFromDocumentMapit
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/t5IS6M).
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/xX8pDD
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/xX8pDDplay()
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/ximf56
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/ximf56Iframe
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gle/chrome-insecure-origins
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google-analytics.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://googlevideo.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gvt1.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gvt2.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gvt6.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://hackerone.com/reports/541502
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://hg.mozilla.org/mozilla-central/file/tip/netwerk/base/nsURLParsers.cpp
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/comms.html#the-websocket-interface
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://medium.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodei.co/npm/require-directory.png?downloads=true&stars=true)
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodei.co/npm/require-directory/)
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2375843554.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/api/fs.html#fs_stat_time_values)
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/dist
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://npmjs.org/package/require-directory))
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://opensource.apple.com/source/xnu/
Source: cMqyGFCQHk.exe, 00000000.00000003.2449217643.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://passwords.google.com
Source: cMqyGFCQHk.exe, 00000000.00000003.2448461981.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://passwords.google.comAkun
Source: cMqyGFCQHk.exe, 00000000.00000003.2450504066.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://passwords.google.comConta
Source: cMqyGFCQHk.exe, 00000000.00000003.2448284804.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449380697.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448748666.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448658210.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448359715.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449882670.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449000858.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://passwords.google.comGoogle
Source: cMqyGFCQHk.exe, 00000000.00000003.2450196344.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://passwords.google.comGoogle-accountOpgeslagen
Source: cMqyGFCQHk.exe, 00000000.00000003.2450380398.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://passwords.google.comKonta
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://polymer-library.polymer-project.org
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/pyparsing
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/six/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.python.org/pypi/pyfakefs
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.python.org/pypi/webapp2
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://quiche.googlesource.com/quiche
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://redux.js.org/
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://secure.travis-ci.org/troygoode/node-require-directory.png)
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://semver.org/
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://shorturl.at/drFY7)
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sindresorhus.com
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sindresorhus.com)
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/site/gaviotachessuser/Home/endgame-tablebases-1
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sizzlejs.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://skia.org/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://source.chromium.org/chromium/chromium/src/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://source.corp.google.com/piper///depot/google3/third_party/tamachiyomi/README.md
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sourceforge.net/projects/wtl/files/WTL%2010/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sqlite.org/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ssl.gstatic.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2448284804.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450196344.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448875642.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449217643.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448162228.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449380697.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449616067.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450088927.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448748666.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449751499.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448658210.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448359715.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449000858.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: cMqyGFCQHk.exe, 00000000.00000003.2448284804.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448461981.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448875642.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450504066.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449217643.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450380398.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448162228.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449380697.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449616067.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450088927.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448748666.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449751499.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448658210.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448359715.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449000858.00000000055B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://swiftshader.googlesource.com/SwiftShader
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/security
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/security).
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc6455#section-9.1
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tukaani.org/xz/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tukaani.org/xz/>.
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/intent/user?screen_name=troygoode)
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://unpkg.com/cliui
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://unpkg.com/yargs-parser
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#concept-url-origin
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#forbidden-host-code-point
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://v8.dev/
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/aria/#aria-hidden.
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/aria/#aria-hidden.Blocked
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/aria/#namefromprohibited.
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/uievents/#legacy-event-types)
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webkit.org/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/4664843055398912
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5738264052891648
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5738264052891648Renderer.Font.PrimaryFont.FCPRenderer.Font.Prim
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromium.org
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.cl.cam.ac.uk/%7Emgk25/ucs/utf8_check.c
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.khronos.org/registry/
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.khronos.org/spir/visualizer/
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/wrap-ansi
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.opensource.org/licenses/bsd-license.php)
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.patreon.com/feross
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.unicode.org/copyright.html.
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://xhr.spec.whatwg.org/.
Source: cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yargs.js.org/
Source: cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://zod.dev
Source: cMqyGFCQHk.exe, 00000000.00000003.2379407887.0000000006973000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: GetRawInputDatamemstr_1d1e5bb2-5

System Summary

barindex
Drops large PE files
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile dump: Teams.exe.0.dr 188819968Jump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile dump: Teams.exe0.0.dr 188819968Jump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeProcess token adjusted: SecurityJump to behavior
Source: cMqyGFCQHk.exeStatic PE information: invalid certificate
Source: Teams.exe0.0.drStatic PE information: Number of sections : 15 > 10
Source: Teams.exe.0.drStatic PE information: Number of sections : 15 > 10
Source: cMqyGFCQHk.exe, 00000000.00000003.2265795013.0000000005F16000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs cMqyGFCQHk.exe
Source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dllb! vs cMqyGFCQHk.exe
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dllb! vs cMqyGFCQHk.exe
Source: cMqyGFCQHk.exe, 00000000.00000003.2390610484.00000000047BB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs cMqyGFCQHk.exe
Source: cMqyGFCQHk.exe, 00000000.00000003.2447177094.00000000047BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevk_swiftshader.dll, vs cMqyGFCQHk.exe
Source: cMqyGFCQHk.exe, 00000000.00000003.2402682137.00000000047B4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename, vs cMqyGFCQHk.exe
Source: cMqyGFCQHk.exe, 00000000.00000003.2375843554.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevk_swiftshader.dll, vs cMqyGFCQHk.exe
Source: cMqyGFCQHk.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: mal60.spre.winEXE@28/107@0/0
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5896:120:WilError_03
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeMutant created: \Sessions\1\BaseNamedObjects\mfx_d3d_mutex
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2184:120:WilError_03
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeMutant created: \Sessions\1\BaseNamedObjects\8013f783-e1a2-5f53-80da-b1ad483bd59f
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:340:120:WilError_03
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsqC4C.tmpJump to behavior
Source: cMqyGFCQHk.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TEAMS.EXE'
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT name FROM sqlite_master WHERE type='table';
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile read: C:\Users\user\Desktop\cMqyGFCQHk.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\cMqyGFCQHk.exe "C:\Users\user\Desktop\cMqyGFCQHk.exe"
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Teams.exe" /FO csv | "C:\Windows\system32\find.exe" "Teams.exe"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Teams.exe" /FO csv
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe "C:\Windows\system32\find.exe" "Teams.exe"
Source: unknownProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe"
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1708,i,13854425415668292357,6166449907864565243,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2576,i,13854425415668292357,6166449907864565243,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:3
Source: unknownProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe"
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()""
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1808,i,11489529828536578193,12839987917968536577,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2424,i,11489529828536578193,12839987917968536577,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Teams.exe" /FO csv | "C:\Windows\system32\find.exe" "Teams.exe"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Teams.exe" /FO csv Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe "C:\Windows\system32\find.exe" "Teams.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1708,i,13854425415668292357,6166449907864565243,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2576,i,13854425415668292357,6166449907864565243,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:3Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1808,i,11489529828536578193,12839987917968536577,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2424,i,11489529828536578193,12839987917968536577,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dllJump to behavior
Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mmdevapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: devobj.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mscms.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: coloradapterclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: duser.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: xmllite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: atlthunk.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mf.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mfplat.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: rtworkq.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mmdevapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: devobj.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mscms.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: coloradapterclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mf.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mfplat.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: rtworkq.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mpr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: scrrun.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Teams.exe" /FO csv
Source: MyElectronApp.lnk.14.drLNK file: ..\..\..\..\..\..\Local\Programs\Teams\Teams.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\8013f783-e1a2-5f53-80da-b1ad483bd59fJump to behavior
Source: cMqyGFCQHk.exeStatic file information: File size 86797392 > 1048576
Source: cMqyGFCQHk.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: ffmpeg.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2392381415.00000000047BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2390610484.00000000047BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vulkan-1.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2368310453.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2374409262.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2368094273.0000000002D20000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdbGCTL source: cMqyGFCQHk.exe, 00000000.00000003.2390610484.00000000047BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: electron.exe.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2379407887.0000000006973000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vk_swiftshader.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2447177094.00000000047BC000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2375843554.0000000005EF0000.00000004.00001000.00020000.00000000.sdmp
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .retplne
Source: vk_swiftshader.dll.0.drStatic PE information: section name: _RDATA
Source: vulkan-1.dll.0.drStatic PE information: section name: .gxfg
Source: vulkan-1.dll.0.drStatic PE information: section name: .retplne
Source: vulkan-1.dll.0.drStatic PE information: section name: _RDATA
Source: ffmpeg.dll.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll.0.drStatic PE information: section name: _RDATA
Source: libEGL.dll.0.drStatic PE information: section name: .gxfg
Source: libEGL.dll.0.drStatic PE information: section name: .retplne
Source: libEGL.dll.0.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll.0.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll.0.drStatic PE information: section name: .retplne
Source: libGLESv2.dll.0.drStatic PE information: section name: _RDATA
Source: ffmpeg.dll0.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll0.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll0.0.drStatic PE information: section name: _RDATA
Source: libEGL.dll0.0.drStatic PE information: section name: .gxfg
Source: libEGL.dll0.0.drStatic PE information: section name: .retplne
Source: libEGL.dll0.0.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll0.0.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll0.0.drStatic PE information: section name: .retplne
Source: libGLESv2.dll0.0.drStatic PE information: section name: _RDATA
Source: fastlist-0.3.0-x64.exe.0.drStatic PE information: section name: _RDATA
Source: Teams.exe.0.drStatic PE information: section name: .gxfg
Source: Teams.exe.0.drStatic PE information: section name: .retplne
Source: Teams.exe.0.drStatic PE information: section name: .rodata
Source: Teams.exe.0.drStatic PE information: section name: CPADinfo
Source: Teams.exe.0.drStatic PE information: section name: LZMADEC
Source: Teams.exe.0.drStatic PE information: section name: _RDATA
Source: Teams.exe.0.drStatic PE information: section name: malloc_h
Source: Teams.exe.0.drStatic PE information: section name: prot
Source: Teams.exe0.0.drStatic PE information: section name: .gxfg
Source: Teams.exe0.0.drStatic PE information: section name: .retplne
Source: Teams.exe0.0.drStatic PE information: section name: .rodata
Source: Teams.exe0.0.drStatic PE information: section name: CPADinfo
Source: Teams.exe0.0.drStatic PE information: section name: LZMADEC
Source: Teams.exe0.0.drStatic PE information: section name: _RDATA
Source: Teams.exe0.0.drStatic PE information: section name: malloc_h
Source: Teams.exe0.0.drStatic PE information: section name: prot
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Programs\Teams\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exeJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\Teams.exeJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Programs\Teams\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exeJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Programs\Teams\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\SpiderBanner.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Programs\Teams\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\nsExec.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Programs\Teams\LICENSE.electron.txtJump to behavior

Boot Survival

barindex
Powershell creates an autostart link
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: .lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell user required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module via navigations and search. Tags = @('powershell','unit testing','bdd','tdd','mocking') # The web address of an icon which can be
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: .lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell user required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module via navigations and search. Tags = @('powershell','unit testing','bdd','tdd','mocking') # The web address of an icon which can be
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnkJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnkJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4414Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2732Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3013
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1596
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exeJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Teams\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Teams\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exeJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Teams\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\SpiderBanner.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\nsExec.dllJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7076Thread sleep count: 4414 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7076Thread sleep count: 2732 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3976Thread sleep time: -4611686018427385s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4900Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5812Thread sleep count: 3013 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2064Thread sleep count: 1596 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6852Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4368Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\localesJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpackedJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpacked\node_modulesJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-listJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendorJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resourcesJump to behavior
Source: cMqyGFCQHk.exe, 00000000.00000003.2449983631.0000000004310000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{5
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: bCK1sK9IRQq9qEmUv4RDsNuESgMjGWdqb8FuvAY5N9GIIvejQjBAMA8GA1UdEwEB/wQFMAMB
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMware
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: (IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSDKVersion() < 27 && IsAdreno5xxOrOlder(functions)) || (!isMesa && IsMaliT8xxOrOlder(functions)) || (!isMesa && IsMaliG31OrOlder(functions))
Source: cMqyGFCQHk.exe, 00000000.00000003.2449947151.000000000432A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: }\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}3
Source: cMqyGFCQHk.exe, 00000000.00000003.2392381415.00000000047BE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tgaR
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: cMqyGFCQHk.exe, 00000000.00000003.2392381415.00000000047BE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Screen Codec / VMware Video
Source: cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ZAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTestp
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Teams.exe" /FO csv | "C:\Windows\system32\find.exe" "Teams.exe"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Teams.exe" /FO csv Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe "C:\Windows\system32\find.exe" "Teams.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1708,i,13854425415668292357,6166449907864565243,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2576,i,13854425415668292357,6166449907864565243,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:3Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1808,i,11489529828536578193,12839987917968536577,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2424,i,11489529828536578193,12839987917968536577,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\teams" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1708,i,13854425415668292357,6166449907864565243,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\teams\teams.exe';$s.save()""
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\teams" --field-trial-handle=2576,i,13854425415668292357,6166449907864565243,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\teams\teams.exe';$s.save()""
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\teams" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1808,i,11489529828536578193,12839987917968536577,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\teams" --field-trial-handle=2424,i,11489529828536578193,12839987917968536577,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\teams" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1708,i,13854425415668292357,6166449907864565243,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\teams\teams.exe';$s.save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\teams" --field-trial-handle=2576,i,13854425415668292357,6166449907864565243,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\teams\teams.exe';$s.save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\teams" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1808,i,11489529828536578193,12839987917968536577,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\teams" --field-trial-handle=2424,i,11489529828536578193,12839987917968536577,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3Jump to behavior
Source: cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ..\..\third_party\webrtc\modules\desktop_capture\win\window_capture_utils.ccFail to create instance of VirtualDesktopManagerChrome_WidgetWin_Progman..\..\third_party\webrtc\modules\desktop_capture\cropping_window_capturer.ccWindow no longer on top when ScreenCapturer finishesScreenCapturer failed to capture a frameWindow rect is emptyWindow is outside of the captured displaySysShadowWebRTC.DesktopCapture.Win.WindowGdiCapturerFrameTime..\..\third_party\webrtc\modules\desktop_capture\win\window_capturer_win_gdi.ccWindow hasn't been selected: Target window has been closed.Failed to get drawable window area: Failed to get window DC: Failed to create frame.Both PrintWindow() and BitBlt() failed.Capturing owned window failed (previous error/warning pertained to that)WindowCapturerWinGdi::CaptureFrameWebRTC.DesktopCapture.BlankFrameDetectedWebRTC.DesktopCapture.PrimaryCapturerSelectSourceErrorWebRTC.DesktopCapture.PrimaryCapturerErrorWebRTC.DesktopCapture.PrimaryCapturerPermanentErrordwmapi.dllDwmEnableComposition..\..\third_party\webrtc\modules\desktop_capture\win\screen_capturer_win_gdi.ccFailed to capture screen by GDI.WebRTC.DesktopCapture.Win.ScreenGdiCapturerFrameTimedesktop_dc_memory_dc_Failed to get screen rect.Failed to create frame buffer.Failed to select current bitmap into memery dc.BitBlt failedScreenCapturerWinGdi::CaptureFrame..\..\third_party\webrtc\modules\desktop_capture\win\cursor.ccwebrtc::CreateMouseCursorFromHCursorUnable to get cursor icon info. Error = Unable to get bitmap info. Error = Unable to get bitmap bits. Error = `
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Users VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Users\user VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Users\user\AppData\Local\Programs VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Users VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Users\user VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Users\user\AppData VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Users\user\AppData\Local\Programs VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Teams VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Teams\resources VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Users\user\AppData\Roaming\Teams\Local State VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Users\user\AppData\Roaming\Teams\config.json VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Users\user\AppData\Roaming\Teams\config.json VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Windows Management Instrumentation		1
Windows Service		1
Windows Service		1
Masquerading		11
Input Capture		1
Security Software Discovery		Remote Services11
Input Capture		Data ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Command and Scripting Interpreter		12
Registry Run Keys / Startup Folder		12
Process Injection		21
Virtualization/Sandbox Evasion		LSASS Memory3
Process Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
PowerShell		1
DLL Side-Loading		12
Registry Run Keys / Startup Folder		12
Process Injection		Security Account Manager21
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
DLL Side-Loading		1
DLL Side-Loading		NTDS1
Application Window Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets1
Remote System Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials2
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync34
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1556006 Sample: cMqyGFCQHk.exe Startdate: 14/11/2024 Architecture: WINDOWS Score: 60 55 Sigma detected: Powershell create lnk in startup 2->55 57 Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE 2->57 7 cMqyGFCQHk.exe 11 226 2->7         started        11 Teams.exe 4 2->11         started        13 Teams.exe 1 2->13         started        process3 file4 47 C:\Users\user\AppData\Local\...\Teams.exe, PE32+ 7->47 dropped 49 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 7->49 dropped 51 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 7->51 dropped 53 17 other files (none is malicious) 7->53 dropped 61 Drops large PE files 7->61 15 cmd.exe 1 7->15         started        17 cmd.exe 1 11->17         started        19 Teams.exe 1 11->19         started        21 Teams.exe 1 11->21         started        23 cmd.exe 13->23         started        25 Teams.exe 1 13->25         started        27 Teams.exe 1 13->27         started        signatures5 process6 process7 29 conhost.exe 15->29         started        31 tasklist.exe 1 15->31         started        33 find.exe 1 15->33         started        35 powershell.exe 17 17->35         started        39 conhost.exe 17->39         started        41 conhost.exe 23->41         started        43 powershell.exe 23->43         started        file8 45 C:\Users\user\AppData\...\MyElectronApp.lnk, MS 35->45 dropped 59 Powershell creates an autostart link 35->59 signatures9

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Programs\Teams\Teams.exe0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Teams\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Teams\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Teams\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Teams\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\Teams.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\elevate.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\vulkan-1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\SpiderBanner.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\StdUtils.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\nsExec.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\nsis7z.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://w3c.github.io/aria/#namefromprohibited.0%Avira URL Cloudsafe
https://anglebug.com/422667400%Avira URL Cloudsafe
https://anglebug.com/422667450%Avira URL Cloudsafe
https://yargs.js.org/0%Avira URL Cloudsafe
https://secure.travis-ci.org/troygoode/node-require-directory.png)0%Avira URL Cloudsafe
https://anglebug.com/422657820%Avira URL Cloudsafe
http://anglebug.com/422630310%Avira URL Cloudsafe
https://anglebug.com/422667480%Avira URL Cloudsafe
http://anglebug.com/400966610%Avira URL Cloudsafe
https://nodei.co/npm/require-directory/)0%Avira URL Cloudsafe
http://anglebug.com/400964540%Avira URL Cloudsafe
https://tukaani.org/xz/&gt;.0%Avira URL Cloudsafe
https://anglebug.com/422658770%Avira URL Cloudsafe
https://w3c.github.io/aria/#aria-hidden.0%Avira URL Cloudsafe
http://fresc81.github.io/node-winreg0%Avira URL Cloudsafe
http://anglebug.com/406446630%Avira URL Cloudsafe
http://anglebug.com/422640080%Avira URL Cloudsafe
http://anglebug.com/422622470%Avira URL Cloudsafe
http://anglebug.com/400967580%Avira URL Cloudsafe
http://anglebug.com/422659950%Avira URL Cloudsafe
http://anglebug.com/42261924allowClearForRobustResourceInitSome0%Avira URL Cloudsafe
http://anglebug.com/400966430%Avira URL Cloudsafe
http://anglebug.com/422666100%Avira URL Cloudsafe
http://anglebug.com/400966480%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://github.com/lgeiger/node-abi/issues/54cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
    		high
    https://github.com/mcollina/reusify#readmecMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
      		high
      https://url.spec.whatwg.org/#concept-url-origincMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
        		high
        https://github.com/gpuweb/gpuweb/wiki/Implementation-Status#implementation-statuscMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpfalse
          		high
          https://github.com/simplejson/simplejsoncMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpfalse
            		high
            https://support.google.com/chrome/answer/6098869cMqyGFCQHk.exe, 00000000.00000003.2448284804.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448461981.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448875642.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450504066.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449217643.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450380398.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448162228.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449380697.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449616067.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450088927.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448748666.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449751499.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448658210.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448359715.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449000858.00000000055B1000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              http://anglebug.com/40096661cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://github.com/prebuild/prebuild-installcMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                https://github.com/vercel/pkg-fetch/actions/runs/2638965835cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                  		high
                  https://github.com/jesec/pkg-fetch/actions/runs/2639072106cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                    		high
                    https://github.com/feross/queue-microtaskcMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                      		high
                      https://github.com/nodejs/string_decodercMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        https://goo.gl/7K7WLuThecMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          https://docs.google.com/cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            https://crbug.com/1356053cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              https://secure.travis-ci.org/troygoode/node-require-directory.png)cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              https://goo.gl/7K7WLucMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpfalse
                                		high
                                https://chrome.google.com/webstore?hl=pl&category=theme81https://myactivity.google.com/myactivity/?ucMqyGFCQHk.exe, 00000000.00000003.2450380398.00000000055B1000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3C//DTDcMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpfalse
                                    		high
                                    https://www.patreon.com/ferosscMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		high
                                      https://goo.gl/t5IS6M).cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpfalse
                                        		high
                                        http://crbug.com/110263cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		high
                                          https://github.com/vercel/pkg-fetch/actions/runs/2638965968cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		high
                                            https://anglebug.com/42265782cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://yargs.js.org/cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://semver.org/cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              https://github.com/google/pprof/tree/master/protocMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://github.com/jrmuizel/qcms/tree/v4cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://npmjs.org/package/require-directory))cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://chromium.googlesource.com/chromium/src/cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2379407887.0000000006973000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://w3c.github.io/aria/#namefromprohibited.cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://bit.ly/3rpDuEX.cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://crbug.com/593024cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://anglebug.com/42266748cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://github.com/tensorflow/modelscMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://anglebug.com/42266745cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://c.docs.google.com/cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://github.com/KhronosGroup/SPIRV-Headers.gitcMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://anglebug.com/42266740cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                http://anglebug.com/42263031cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://nodei.co/npm/require-directory/)cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://crbug.com/1300575cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://crbug.com/710443cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWithcMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://github.com/tensorflow/tflite-supportcMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://github.com/WICG/scheduling-apiscMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://anglebug.com/42264008cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          https://pypi.org/project/pyparsingcMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://sqlite.org/cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://chrome.google.com/webstore?hl=id&category=theme81https://myactivity.google.com/myactivity/?ucMqyGFCQHk.exe, 00000000.00000003.2448461981.00000000055B1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://code.google.com/p/v8/wiki/JavaScriptStackTraceApicMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://crbug.com/1060012cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://code.google.com/p/chromium/issues/detail?id=25916cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://www.opensource.org/licenses/mit-license.php)cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://stackoverflow.com/a/1068308/13216cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://github.com/jesec/pkg-fetch/actions/runs/2639072371cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://crbug.com/642605cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://twitter.com/intent/user?screen_name=troygoode)cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://anglebug.com/40096454cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                https://github.com/gpuweb/gpuweb/wiki/Implementation-Status#implementation-statusFailedcMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://github.com/libuv/libuv/pull/1088cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://tukaani.org/xz/&gt;.cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    http://fresc81.github.io/node-winregcMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    https://sizzlejs.com/cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://anglebug.com/40644663cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      https://crbug.com/650547callClearTwiceUsingcMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://medium.com/cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://html4/loose.dtdcMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://crbug.com/1420130cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://www.portaudio.comcMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://beacons.gcp.gvt2.com/domainreliability/uploadcMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2379407887.0000000006973000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://github.com/inspect-js/node-supports-preserve-symlinks-flag.gitcMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://github.com/vercel/pkg-fetch/actions/runs/2068735040cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://anglebug.com/42265877cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      • Avira URL Cloud: safe
                                                                                                                      		unknown
                                                                                                                      https://github.com/vercel/pkg-fetch/actions/runs/752615557cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://github.com/RyanZim/universalify.gitcMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://w3c.github.io/aria/#aria-hidden.cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          • Avira URL Cloud: safe
                                                                                                                          		unknown
                                                                                                                          https://developer.chrome.com/docs/extensions/mv3/cross-origin-isolation/.cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://github.com/google/shell-encryptioncMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://anglebug.com/42265995cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                		unknown
                                                                                                                                https://github.com/wasdk/wasmparsercMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://anglebug.com/42262247cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                  		unknown
                                                                                                                                  https://unpkg.com/cliuicMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://github.com/dpranke/typ.gitcMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://github.com/nodejs/node/issues/8987cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://github.com/vercel/pkg-fetch/actions/runs/752615423cMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://chromeenterprise.google/policies/#BrowserSwitcherUrlListcMqyGFCQHk.exe, 00000000.00000003.2448284804.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450196344.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448461981.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450504066.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2450088927.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2448658210.00000000055B1000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2449882670.00000000055B1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://anglebug.com/40096758cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                            		unknown
                                                                                                                                            https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setintervalcMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://anglebug.com/42261924allowClearForRobustResourceInitSomecMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                              		unknown
                                                                                                                                              https://www.khronos.org/registry/cMqyGFCQHk.exe, 00000000.00000003.2397805375.00000000047B4000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2239552581.00000000053B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                http://anglebug.com/42266610cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                		unknown
                                                                                                                                                https://github.com/sponsors/ferosscMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://.jpgcMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006788000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://xhr.spec.whatwg.org/.cMqyGFCQHk.exe, 00000000.00000003.2377337373.0000000006430000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      http://anglebug.com/40096643cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                                      		unknown
                                                                                                                                                      https://www.khronos.org/spir/visualizer/cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        http://anglebug.com/40096648cMqyGFCQHk.exe, 00000000.00000003.2395639006.00000000047B2000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2270843207.0000000005EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                                        		unknown
                                                                                                                                                        https://sindresorhus.comcMqyGFCQHk.exe, 00000000.00000003.2259845772.0000000004EB0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                          		high

                                                                                                                                                          World Map of Contacted IPs

                                                                                                                                                          ⊘No contacted IP infos

                                                                                                                                                          General Information

                                                                                                                                                          Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                          Analysis ID:1556006
                                                                                                                                                          Start date and time:2024-11-14 19:44:15 +01:00
                                                                                                                                                          Joe Sandbox product:CloudBasic
                                                                                                                                                          Overall analysis duration:0h 8m 32s
                                                                                                                                                          Hypervisor based Inspection enabled:false
                                                                                                                                                          Report type:full
                                                                                                                                                          Cookbook file name:default.jbs
                                                                                                                                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                          Number of analysed new started processes analysed:24
                                                                                                                                                          Number of new started drivers analysed:0
                                                                                                                                                          Number of existing processes analysed:0
                                                                                                                                                          Number of existing drivers analysed:0
                                                                                                                                                          Number of injected processes analysed:0
                                                                                                                                                          Technologies:
                                                                                                                                                          • HCA enabled
                                                                                                                                                          • EGA enabled
                                                                                                                                                          • AMSI enabled
                                                                                                                                                          Analysis Mode:default
                                                                                                                                                          Analysis stop reason:Timeout
                                                                                                                                                          Sample name:cMqyGFCQHk.exe
                                                                                                                                                          renamed because original name is a hash value
                                                                                                                                                          Original Sample Name:3c3f458400c557d279c4d4993f67adc8ba3da4bad8fc844adfef8c7de475a1f7.exe
                                                                                                                                                          Detection:MAL
                                                                                                                                                          Classification:mal60.spre.winEXE@28/107@0/0
                                                                                                                                                          EGA Information:Failed
                                                                                                                                                          HCA Information:
                                                                                                                                                          • Successful, ratio: 100%
                                                                                                                                                          • Number of executed functions: 0
                                                                                                                                                          • Number of non-executed functions: 0
                                                                                                                                                          Cookbook Comments:
                                                                                                                                                          • Found application associated with file extension: .exe

                                                                                                                                                          Warnings

                                                                                                                                                          • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                                                                                                                                          • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                          • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                          • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                          • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                          • VT rate limit hit for: cMqyGFCQHk.exe

                                                                                                                                                          Simulations

                                                                                                                                                          Behavior and APIs

                                                                                                                                                          TimeTypeDescription
                                                                                                                                                          13:45:25API Interceptor21x Sleep call for process: cMqyGFCQHk.exe modified
                                                                                                                                                          13:45:45API Interceptor14x Sleep call for process: powershell.exe modified
                                                                                                                                                          19:45:49AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk

                                                                                                                                                          Joe Sandbox View / Context

                                                                                                                                                          IPs

                                                                                                                                                          ⊘No context

                                                                                                                                                          Domains

                                                                                                                                                          ⊘No context

                                                                                                                                                          ASNs

                                                                                                                                                          ⊘No context

                                                                                                                                                          JA3 Fingerprints

                                                                                                                                                          ⊘No context

                                                                                                                                                          Dropped Files

                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                          C:\Users\user\AppData\Local\Programs\Teams\d3dcompiler_47.dllSoltix.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                            Soltix.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                              Prismifyr_Installer_v2.1 Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                Prismifyr_Installer_v2.1 Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                  Prismifyr_Installer_v2.1 Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                    Prismifyr_Installer_v2.1 Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                      svchost.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                        JaborSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          ArenaWarsSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                            ArenaWarsSetup.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                              Created / dropped Files

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):64
                                                                                                                                                                              Entropy (8bit):0.34726597513537405
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3:Nlll:Nll
                                                                                                                                                                              MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                                                                                                                              SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                                                                                                                              SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                                                                                                                              SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:@...e...........................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Teams\LICENSE.electron.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1096
                                                                                                                                                                              Entropy (8bit):5.13006727705212
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                              MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                              SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                              SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                              SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Teams\LICENSES.chromium.html

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:HTML document, ASCII text
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):9099045
                                                                                                                                                                              Entropy (8bit):4.754770173605162
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24576:2o9dQ06p6j6j1WOwRiXjYmfy6k6mjK64jK6gjK6e6cjK6feGjl8PpE:BFOeGT
                                                                                                                                                                              MD5:6FF57C0AECCDF44C39C95DEE9ECEA805
                                                                                                                                                                              SHA1:C76669A1354067A1C3DDBC032E66C323286A8D43
                                                                                                                                                                              SHA-256:0BA4C7B781E9F149195A23D3BE0F704945F858A581871A9FEDD353F12CE839CA
                                                                                                                                                                              SHA-512:D6108E1D1D52AA3199FF051C7B951025DBF51C5CB18E8920304116DCEF567367ED682245900FDA3AD354C5D50AA5A3C4E6872570A839A3A55D3A9B7579BDFA24
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Teams\Teams.exe

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):188819968
                                                                                                                                                                              Entropy (8bit):6.7569707985463126
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:1572864:wwl41lgY+w9QLv1JWYc6UeOtUUGQUT1jdu4BPPuuwT2GOqiB1sr7zjg7ob753oUV:kF4oD0QdG09P
                                                                                                                                                                              MD5:102326801694C938E466C8D96E4200BD
                                                                                                                                                                              SHA1:D2CC5A838F3E69EFE5CB38AE073D336F4E6F859A
                                                                                                                                                                              SHA-256:376A7F107EB0CEB35E3F0DCF6212D2C3DD5EA100FE5A21B8233483644FEA3AE0
                                                                                                                                                                              SHA-512:2EA4204051B9FEDB9BEBE3BE3232298C79ED28DD4000545BAD81FE5B35DB4AB429730E04A4AC3C647356E20777D8A31A16960D609F08D2161DFAF3D04FDDC5F3
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."......FH.........`IY........@.............................@............`..........................................d..k...0...h....`m.......#...H...........q..5..P.......................0...(....}H.@............................................text...*DH......FH................. ..`.rdata.......`H......LH.............@..@.data....H......L..................@....pdata....H...#...H.................@..@.gxfg....B...pl..D....-.............@..@.retplne......l......*...................rodata.......l......,.............. ..`.tls..........l......>..............@...CPADinfo8.....m......D..............@...LZMADEC.......m......F.............. ..`_RDATA.......0m......X..............@..@malloc_h.....@m......Z.............. ..`prot.........Pm......\..............@..@.rsrc........`m......^..............@..@.reloc...5....q..6....1.............@..B................

                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Teams\chrome_100_percent.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):151599
                                                                                                                                                                              Entropy (8bit):7.915992368779121
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
                                                                                                                                                                              MD5:83EC43F2AF9FC52025F3F807B185D424
                                                                                                                                                                              SHA1:EA432F7571D89DD43A76D260CB5853CADA253AA0
                                                                                                                                                                              SHA-256:A659EE9EB38636F85F5336587C578FB29740D3EFFAFF9B92852C8A210E92978C
                                                                                                                                                                              SHA-512:6DDCA85215BF6F7F9B17C5D52BD7395702515BC2354A8CD8FA6C1CCD7355A23B17828853CEABEEF597B5BCA11750DC7C9F6EC3C45A33C2106F816FEC74963D86
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:..........<.............h.....i.\...j.....k.I...l.....n.....o.....p.:...q.4...r.o...s.?...t..!..u..%..v.@'..w..1..x..<..y.l?..z..C..{..G..|..I..}..J..~..M.....O.....R....|V.....Z.....]....N`.....a....3c....gd.....e....@g.....g.....m....~s....Fw....&{.....~..........*.....m................8..........._...........1....V.............w....e........F.........'....Z....k....5...,.....-.h........./.....0.!...1.....6.f...7.....8..!....$....&...../.....1.....5....3:....CE.....F....(O.....U....b[.....`....g....^i.....m.....q....V{....v~..............R...............X.....#.................................................|.....S..........W...........i..........2.....`...........S...........S.....(............................s...........y.....N.....".......................&.............................................Q"....-#.....#....$....v%....?&.....&....*(.... ).....*...........2....33....3.....3.....4....5....v6.....6.....7....f7....7.....7.....>.....A....sB

                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Teams\chrome_200_percent.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):228644
                                                                                                                                                                              Entropy (8bit):7.946488830213853
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
                                                                                                                                                                              MD5:DC48A33BD20BFC7CACFC925A84B015B6
                                                                                                                                                                              SHA1:8DFEE88FD1DC77F89AD88C19146FE3AB45E43F3C
                                                                                                                                                                              SHA-256:2C1B3E4B8A0CF837AE0A390FCA54F45D7D22418E040F1DFEA979622383ACCED6
                                                                                                                                                                              SHA-512:1D54EB5D2BA06AF0BA8F6B491B0D43F178A48AC82CDF383BEB265E732DDFC06BCA9692003FDFCE56F7F00AF97F29ACF046C73B891B8C561610098F9626EAF05A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:..........<.........&...h.....i.....j.....k.....l.....n.....o.|%..p..*..q..-..r.85..s..:..t..>..u.CG..v..K..w.._..x._t..y.{y..z....{.4...|....}.m...~...............................................h.............................5.................t...........-.................D............$.....-....K9.....@....FH...bL...9O...nT...)U...jV...UZ....]...s`...xc...f....j...n..,.\r..-..s....ku../..v..0..w..1.Dx..6..x..7.....8.Q............................F................S..........{...........^.....@...........!....%....&/....R2....:....>....RH....R.....V....|X....Sa.....i....k.....n.....r.....y.....{....%..........`.....7...........................................0.....I..........;.....l.....b.....B.....%.....S.....m..........L...........R..........V...........g.....)........................!.....'....-....u3.....4.....5.....6.....8....:9.....:.....<....=....`?....$L.....\....v\.....\....;].....]....._....._....K`....`.....a....]a....a.....g.....k....Rl

                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Teams\d3dcompiler_47.dll

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4916728
                                                                                                                                                                              Entropy (8bit):6.398031738914566
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
                                                                                                                                                                              MD5:A7B7470C347F84365FFE1B2072B4F95C
                                                                                                                                                                              SHA1:57A96F6FB326BA65B7F7016242132B3F9464C7A3
                                                                                                                                                                              SHA-256:AF7B99BE1B8770C0E4D18E43B04E81D11BDEB667FA6B07ADE7A88F4C5676BF9A
                                                                                                                                                                              SHA-512:83391A219631F750499FD9642D59EC80FB377C378997B302D10762E83325551BB97C1086B181FFF0521B1CA933E518EAB71A44A3578A23691F215EBB1DCE463D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Joe Sandbox View:
                                                                                                                                                                              • Filename: Soltix.exe, Detection: malicious, Browse
                                                                                                                                                                              • Filename: Soltix.exe, Detection: malicious, Browse
                                                                                                                                                                              • Filename: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                                              • Filename: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                                              • Filename: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                                              • Filename: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                                              • Filename: svchost.exe, Detection: malicious, Browse
                                                                                                                                                                              • Filename: JaborSetup.exe, Detection: malicious, Browse
                                                                                                                                                                              • Filename: ArenaWarsSetup.exe, Detection: malicious, Browse
                                                                                                                                                                              • Filename: ArenaWarsSetup.exe, Detection: malicious, Browse
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K......JK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Teams\ffmpeg.dll

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2929152
                                                                                                                                                                              Entropy (8bit):6.70454100720416
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:49152:ZBAnytEwrZu/3Q8rvnh2UGH6qfhtvRIdefZiC6Cry2:ZBFE6kfbrvnh21K+io
                                                                                                                                                                              MD5:5A168CB3EA9D0E7400BAABF60F6AB933
                                                                                                                                                                              SHA1:82A86CB7F42294AB4AD6669C19B92605D960B676
                                                                                                                                                                              SHA-256:AF5F1BC9F6A73750FA0C7BF17439700CFB3AB23E1393F0C9899825417E319B54
                                                                                                                                                                              SHA-512:7C1441ECD049543E38297A7B6929E9F3EB978422D0CE508FBE6350FFEBD297F947B8D9EC75BD2054142DCD8461EEF1BF110E040D0830DA977FDE8944BECE843D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......#...................................................:...........`A..........................................*.......*.(.............9..............:.<5....*.......................*.(.....$.@...........H.*.8............................text.....#.......#................. ..`.rdata........$.......#.............@..@.data.........+.."....+.............@....pdata.......9.......+.............@..@.gxfg....+...0:..,...J,.............@..@.retplne.....`:......v,..................tls.........p:......x,.............@..._RDATA........:......z,.............@..@.reloc..<5....:..6...|,.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Teams\icudtl.dat

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):10468208
                                                                                                                                                                              Entropy (8bit):6.265606239082294
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
                                                                                                                                                                              MD5:FFD67C1E24CB35DC109A24024B1BA7EC
                                                                                                                                                                              SHA1:99F545BC396878C7A53E98A79017D9531AF7C1F5
                                                                                                                                                                              SHA-256:9AE98C06CBB0EA43C5CD6B5725310C008C65E46072421A1118CB88E1DE9A8B92
                                                                                                                                                                              SHA-512:E1A865E685D2D3BACD0916D4238A79462519D887FEB273A251120BB6AF2B4481D025F3B21CE9A1A95A49371A0AA3ECF072175BA756974E831DBFDE1F0FEAEB79
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E...(...E...)...F...).."F...1..5F..`1..EF...N..XF..PN..hF...N..xF.......F.......F.......F..@....F.......F......F..0....F.......G......$G......7G......JG......]G..@...pG.......G.......G..@....G.......G.......G..@....G.......G..p....H..`....H.......H..@...AH......TH..p...gH.....zH.......H..`....H.......H.......H..P....H.......H......H..`....I......%I..P...:I......RI.....bI..@...uI.......I.......I.......I..P....I.......I.......I..0....I.......J... ...J.. !..-J..@$..=J...$..PJ...$..qJ.......J...<...J....&..J....&..J.. .&..J....&..K..`.&..K....&.3K....&.JK..0.&.aK....'.xK....'..K....'..K...(..K....(..K...O)..K....)..L..0Q*.>L..`.*.gL..Pi+..L....+..L...i,..L....,..L..P}-..M..@.-.,M.. .-.EM....-.\M....-.uM....-..M...$...M..0%...M....0..M...j0..M..`.0..N..p.0.1N....0.AN....0.TN..@.0.iN....0..N..0.0..N....0..N....0..N....1..N....1..N..

                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Teams\libEGL.dll

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):493056
                                                                                                                                                                              Entropy (8bit):6.3672588781107775
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:0PfRujpqWG9btH+M1wLPfj9iDcHetGsHUN0dxI2H6sNkD4Fvh2W:eAWt+MWLPfjkVGbN0dxI2H63D4Bh2
                                                                                                                                                                              MD5:39CCF402A62F068A8C573B45EA96154D
                                                                                                                                                                              SHA1:57CEB915EA6F88C7FCCA35339BF951659C0338AB
                                                                                                                                                                              SHA-256:8649D77ACE8E5753B9A10E7AE3349AAFA9D8E3406BA9C8C36A59633A84B3C41B
                                                                                                                                                                              SHA-512:C4F9225C54D413176CB3DD2B26D429493FD056C7C283BC7A1C52B4A2059DBB11380DAF5D847BE1FF29F058BA0EF44D4BF66A3D9E9A600000DC8F6D20DFB2ED03
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .....l................................................................`A.........................................l......h{..(.......x....P..l?..............<....d.......................c..(.......@...........p~...............................text....k.......l.................. ..`.rdata..lr.......t...p..............@..@.data....K....... ..................@....pdata..l?...P...@..................@..@.gxfg... &.......(...D..............@..@.retplne.............l...................tls....!............n..............@..._RDATA...............p..............@..@.rsrc...x............r..............@..@.reloc..<............x..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Teams\libGLESv2.dll

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):8418304
                                                                                                                                                                              Entropy (8bit):6.508090684401189
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:98304:Q7XpFwEPVsR+1HYJnahAB4tVsX43wYMg:QXVrAtsw
                                                                                                                                                                              MD5:F055A130C79BD517BDB53B1F8A38BD3B
                                                                                                                                                                              SHA1:9FBA0AD4BA973BB285B23CC125004BAF61A98B5A
                                                                                                                                                                              SHA-256:45B53759392B81CE7D916B3F1CF02BE30289809BD31D09FC1524EF2609183B17
                                                                                                                                                                              SHA-512:D9DCB217F268862C577CACF4E9F84C63E02B647113D484338A74EB0B24FADD6D87B4E7A551DD1EF692BB38E44562BFF848982ACB62840D4F49F91A7751320E34
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......d...........N......................................`............`A........................................m.w.......x.d....p........}..H....................w.......................w.(.....d.@.............x.......w.@....................text.....d.......d................. ..`.rdata..D.....d.......d.............@..@.data.........y.......y.............@....pdata...H....}..J....}.............@..@.gxfg....-...........d..............@..@.retplne.....@...........................tls....B....P......................@..._RDATA.......`......................@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Teams\resources.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5755390
                                                                                                                                                                              Entropy (8bit):7.996220000544904
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:98304:JZ5ti6+nkrht455GGPeenn0mJSwLEpxIvMi8rwrGU3nAaqdkmYAzFKwR4:j7ilnkrP455GGHnhEXU8kr1Xqdf1FvG
                                                                                                                                                                              MD5:6772B597BF68622D934F207570E771B1
                                                                                                                                                                              SHA1:F2A80FBFA034CB1FA07DC9AA37BF9F5B2280FF13
                                                                                                                                                                              SHA-256:268DE4D99AB7C4F4EE32C8E8CB2B058A2C8D0D839F468AE8E8C0605FEAA736EA
                                                                                                                                                                              SHA-512:A2BE67DF09951C9EF9200DCCCBDFF13736921522191F0001DA539D5C7F26B5B26A6B810BE6963908F216768C98D21E52486C7E00538CC0730E8C78E78811B85B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:............f..#..{.V...|.*1..~..4....OG....aI................V...........@..............................................D9....Dc....D.....D.....D.....D.....D,....D" ...D*$...D.$..HE.$..IE.(..JEx*..SE-/..TE.8..UE.G..VE.h..\E.q..]E.r..^E.s..`E*t..aEty..bE....cExo..dE.Z..eE.[...E.\...E.m...Eho...Exs...E.u...E.{...E.....E....E.....E.....E[....E....EV....E.....E.....E7....E.....E.....E2....E.....L9....L.....L.....L+....LP....L.....L(.../Lo...0L5...1L,)..2L.3...Q.D...Q.P...QdY...Q.\...Q._...Q.j...Q.k...Q.l...QAn...Q.....Q.....R.....R....ZdA&..[d"(..\d:=..]d.@..^dpA.._d3D..`d.G..adqI...d.T...d.Y...d._...d.m...d.p...dUu...d.v...d.x...d.y...d.|...d;....d....6eL...7e|...8e...9e5...:e....;e....<e....=e....>e#...?e....@eo...Ae....Be=...Cex....gp....ga0...g.2.....3.....6.....*....X+.....2.....2.....4.....9.....L....K...........a.....g.....9.....Y.................7... .>...<..L..=..M..>..S..?..X..@.cZ..B.]g..C..i..D..s..E..v..F..w..G.i...H.....I.....J.....K.]...L.....M.....N.S...O._...P.L...Q...

                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Teams\snapshot_blob.bin

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):316538
                                                                                                                                                                              Entropy (8bit):4.177181507694743
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3072:p+JfFRciefJNlUMX2kIE1aOaVsS/3hYeFWYSITdJgClE+ceNTbM:pefPciePmMXh1aOCsy3hpFRlzVw
                                                                                                                                                                              MD5:C8950B01F336B05609976546B1A007E6
                                                                                                                                                                              SHA1:F04D0B0369007BBE6A7FE129B31B19DD1822F32F
                                                                                                                                                                              SHA-256:9B3A75A713E41BC73F219858FCAC8E3031BA22732285ED3A64DC48074C725CC2
                                                                                                                                                                              SHA-512:B7DB4277290E849A52AD5D31FF65AB5D2B75C2125D67EEEE02B09E4E7001AA46D10BF89429C65695C7560D1C45B898C20275EB9E36CD8B259707FFB8B298F103
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:..........(.._.13.0.245.16-electron.0..........................................`L..............l....K..}.a........a........a2.......aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bkkv1ur1.rj4.ps1

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):60
                                                                                                                                                                              Entropy (8bit):4.038920595031593
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dpp0s5ix.o1t.psm1

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):60
                                                                                                                                                                              Entropy (8bit):4.038920595031593
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ji1uvzij.pud.psm1

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):60
                                                                                                                                                                              Entropy (8bit):4.038920595031593
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wjbezpvp.4uw.ps1

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):60
                                                                                                                                                                              Entropy (8bit):4.038920595031593
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\LICENSE.electron.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1096
                                                                                                                                                                              Entropy (8bit):5.13006727705212
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                              MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                              SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                              SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                              SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\LICENSES.chromium.html

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:HTML document, ASCII text
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):9099045
                                                                                                                                                                              Entropy (8bit):4.754770173605162
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24576:2o9dQ06p6j6j1WOwRiXjYmfy6k6mjK64jK6gjK6e6cjK6feGjl8PpE:BFOeGT
                                                                                                                                                                              MD5:6FF57C0AECCDF44C39C95DEE9ECEA805
                                                                                                                                                                              SHA1:C76669A1354067A1C3DDBC032E66C323286A8D43
                                                                                                                                                                              SHA-256:0BA4C7B781E9F149195A23D3BE0F704945F858A581871A9FEDD353F12CE839CA
                                                                                                                                                                              SHA-512:D6108E1D1D52AA3199FF051C7B951025DBF51C5CB18E8920304116DCEF567367ED682245900FDA3AD354C5D50AA5A3C4E6872570A839A3A55D3A9B7579BDFA24
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\Teams.exe

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):188819968
                                                                                                                                                                              Entropy (8bit):6.7569707985463126
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:1572864:wwl41lgY+w9QLv1JWYc6UeOtUUGQUT1jdu4BPPuuwT2GOqiB1sr7zjg7ob753oUV:kF4oD0QdG09P
                                                                                                                                                                              MD5:102326801694C938E466C8D96E4200BD
                                                                                                                                                                              SHA1:D2CC5A838F3E69EFE5CB38AE073D336F4E6F859A
                                                                                                                                                                              SHA-256:376A7F107EB0CEB35E3F0DCF6212D2C3DD5EA100FE5A21B8233483644FEA3AE0
                                                                                                                                                                              SHA-512:2EA4204051B9FEDB9BEBE3BE3232298C79ED28DD4000545BAD81FE5B35DB4AB429730E04A4AC3C647356E20777D8A31A16960D609F08D2161DFAF3D04FDDC5F3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."......FH.........`IY........@.............................@............`..........................................d..k...0...h....`m.......#...H...........q..5..P.......................0...(....}H.@............................................text...*DH......FH................. ..`.rdata.......`H......LH.............@..@.data....H......L..................@....pdata....H...#...H.................@..@.gxfg....B...pl..D....-.............@..@.retplne......l......*...................rodata.......l......,.............. ..`.tls..........l......>..............@...CPADinfo8.....m......D..............@...LZMADEC.......m......F.............. ..`_RDATA.......0m......X..............@..@malloc_h.....@m......Z.............. ..`prot.........Pm......\..............@..@.rsrc........`m......^..............@..@.reloc...5....q..6....1.............@..B................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\chrome_100_percent.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):151599
                                                                                                                                                                              Entropy (8bit):7.915992368779121
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
                                                                                                                                                                              MD5:83EC43F2AF9FC52025F3F807B185D424
                                                                                                                                                                              SHA1:EA432F7571D89DD43A76D260CB5853CADA253AA0
                                                                                                                                                                              SHA-256:A659EE9EB38636F85F5336587C578FB29740D3EFFAFF9B92852C8A210E92978C
                                                                                                                                                                              SHA-512:6DDCA85215BF6F7F9B17C5D52BD7395702515BC2354A8CD8FA6C1CCD7355A23B17828853CEABEEF597B5BCA11750DC7C9F6EC3C45A33C2106F816FEC74963D86
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:..........<.............h.....i.\...j.....k.I...l.....n.....o.....p.:...q.4...r.o...s.?...t..!..u..%..v.@'..w..1..x..<..y.l?..z..C..{..G..|..I..}..J..~..M.....O.....R....|V.....Z.....]....N`.....a....3c....gd.....e....@g.....g.....m....~s....Fw....&{.....~..........*.....m................8..........._...........1....V.............w....e........F.........'....Z....k....5...,.....-.h........./.....0.!...1.....6.f...7.....8..!....$....&...../.....1.....5....3:....CE.....F....(O.....U....b[.....`....g....^i.....m.....q....V{....v~..............R...............X.....#.................................................|.....S..........W...........i..........2.....`...........S...........S.....(............................s...........y.....N.....".......................&.............................................Q"....-#.....#....$....v%....?&.....&....*(.... ).....*...........2....33....3.....3.....4....5....v6.....6.....7....f7....7.....7.....>.....A....sB

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\chrome_200_percent.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):228644
                                                                                                                                                                              Entropy (8bit):7.946488830213853
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
                                                                                                                                                                              MD5:DC48A33BD20BFC7CACFC925A84B015B6
                                                                                                                                                                              SHA1:8DFEE88FD1DC77F89AD88C19146FE3AB45E43F3C
                                                                                                                                                                              SHA-256:2C1B3E4B8A0CF837AE0A390FCA54F45D7D22418E040F1DFEA979622383ACCED6
                                                                                                                                                                              SHA-512:1D54EB5D2BA06AF0BA8F6B491B0D43F178A48AC82CDF383BEB265E732DDFC06BCA9692003FDFCE56F7F00AF97F29ACF046C73B891B8C561610098F9626EAF05A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:..........<.........&...h.....i.....j.....k.....l.....n.....o.|%..p..*..q..-..r.85..s..:..t..>..u.CG..v..K..w.._..x._t..y.{y..z....{.4...|....}.m...~...............................................h.............................5.................t...........-.................D............$.....-....K9.....@....FH...bL...9O...nT...)U...jV...UZ....]...s`...xc...f....j...n..,.\r..-..s....ku../..v..0..w..1.Dx..6..x..7.....8.Q............................F................S..........{...........^.....@...........!....%....&/....R2....:....>....RH....R.....V....|X....Sa.....i....k.....n.....r.....y.....{....%..........`.....7...........................................0.....I..........;.....l.....b.....B.....%.....S.....m..........L...........R..........V...........g.....)........................!.....'....-....u3.....4.....5.....6.....8....:9.....:.....<....=....`?....$L.....\....v\.....\....;].....]....._....._....K`....`.....a....]a....a.....g.....k....Rl

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\d3dcompiler_47.dll

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4916728
                                                                                                                                                                              Entropy (8bit):6.398031738914566
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
                                                                                                                                                                              MD5:A7B7470C347F84365FFE1B2072B4F95C
                                                                                                                                                                              SHA1:57A96F6FB326BA65B7F7016242132B3F9464C7A3
                                                                                                                                                                              SHA-256:AF7B99BE1B8770C0E4D18E43B04E81D11BDEB667FA6B07ADE7A88F4C5676BF9A
                                                                                                                                                                              SHA-512:83391A219631F750499FD9642D59EC80FB377C378997B302D10762E83325551BB97C1086B181FFF0521B1CA933E518EAB71A44A3578A23691F215EBB1DCE463D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K......JK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\ffmpeg.dll

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2929152
                                                                                                                                                                              Entropy (8bit):6.70454100720416
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:49152:ZBAnytEwrZu/3Q8rvnh2UGH6qfhtvRIdefZiC6Cry2:ZBFE6kfbrvnh21K+io
                                                                                                                                                                              MD5:5A168CB3EA9D0E7400BAABF60F6AB933
                                                                                                                                                                              SHA1:82A86CB7F42294AB4AD6669C19B92605D960B676
                                                                                                                                                                              SHA-256:AF5F1BC9F6A73750FA0C7BF17439700CFB3AB23E1393F0C9899825417E319B54
                                                                                                                                                                              SHA-512:7C1441ECD049543E38297A7B6929E9F3EB978422D0CE508FBE6350FFEBD297F947B8D9EC75BD2054142DCD8461EEF1BF110E040D0830DA977FDE8944BECE843D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......#...................................................:...........`A..........................................*.......*.(.............9..............:.<5....*.......................*.(.....$.@...........H.*.8............................text.....#.......#................. ..`.rdata........$.......#.............@..@.data.........+.."....+.............@....pdata.......9.......+.............@..@.gxfg....+...0:..,...J,.............@..@.retplne.....`:......v,..................tls.........p:......x,.............@..._RDATA........:......z,.............@..@.reloc..<5....:..6...|,.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\icudtl.dat

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):10468208
                                                                                                                                                                              Entropy (8bit):6.265606239082294
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
                                                                                                                                                                              MD5:FFD67C1E24CB35DC109A24024B1BA7EC
                                                                                                                                                                              SHA1:99F545BC396878C7A53E98A79017D9531AF7C1F5
                                                                                                                                                                              SHA-256:9AE98C06CBB0EA43C5CD6B5725310C008C65E46072421A1118CB88E1DE9A8B92
                                                                                                                                                                              SHA-512:E1A865E685D2D3BACD0916D4238A79462519D887FEB273A251120BB6AF2B4481D025F3B21CE9A1A95A49371A0AA3ECF072175BA756974E831DBFDE1F0FEAEB79
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E...(...E...)...F...).."F...1..5F..`1..EF...N..XF..PN..hF...N..xF.......F.......F.......F..@....F.......F......F..0....F.......G......$G......7G......JG......]G..@...pG.......G.......G..@....G.......G.......G..@....G.......G..p....H..`....H.......H..@...AH......TH..p...gH.....zH.......H..`....H.......H.......H..P....H.......H......H..`....I......%I..P...:I......RI.....bI..@...uI.......I.......I.......I..P....I.......I.......I..0....I.......J... ...J.. !..-J..@$..=J...$..PJ...$..qJ.......J...<...J....&..J....&..J.. .&..J....&..K..`.&..K....&.3K....&.JK..0.&.aK....'.xK....'..K....'..K...(..K....(..K...O)..K....)..L..0Q*.>L..`.*.gL..Pi+..L....+..L...i,..L....,..L..P}-..M..@.-.,M.. .-.EM....-.\M....-.uM....-..M...$...M..0%...M....0..M...j0..M..`.0..N..p.0.1N....0.AN....0.TN..@.0.iN....0..N..0.0..N....0..N....0..N....1..N....1..N..

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\libEGL.dll

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):493056
                                                                                                                                                                              Entropy (8bit):6.3672588781107775
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:0PfRujpqWG9btH+M1wLPfj9iDcHetGsHUN0dxI2H6sNkD4Fvh2W:eAWt+MWLPfjkVGbN0dxI2H63D4Bh2
                                                                                                                                                                              MD5:39CCF402A62F068A8C573B45EA96154D
                                                                                                                                                                              SHA1:57CEB915EA6F88C7FCCA35339BF951659C0338AB
                                                                                                                                                                              SHA-256:8649D77ACE8E5753B9A10E7AE3349AAFA9D8E3406BA9C8C36A59633A84B3C41B
                                                                                                                                                                              SHA-512:C4F9225C54D413176CB3DD2B26D429493FD056C7C283BC7A1C52B4A2059DBB11380DAF5D847BE1FF29F058BA0EF44D4BF66A3D9E9A600000DC8F6D20DFB2ED03
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .....l................................................................`A.........................................l......h{..(.......x....P..l?..............<....d.......................c..(.......@...........p~...............................text....k.......l.................. ..`.rdata..lr.......t...p..............@..@.data....K....... ..................@....pdata..l?...P...@..................@..@.gxfg... &.......(...D..............@..@.retplne.............l...................tls....!............n..............@..._RDATA...............p..............@..@.rsrc...x............r..............@..@.reloc..<............x..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\libGLESv2.dll

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):8418304
                                                                                                                                                                              Entropy (8bit):6.508090684401189
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:98304:Q7XpFwEPVsR+1HYJnahAB4tVsX43wYMg:QXVrAtsw
                                                                                                                                                                              MD5:F055A130C79BD517BDB53B1F8A38BD3B
                                                                                                                                                                              SHA1:9FBA0AD4BA973BB285B23CC125004BAF61A98B5A
                                                                                                                                                                              SHA-256:45B53759392B81CE7D916B3F1CF02BE30289809BD31D09FC1524EF2609183B17
                                                                                                                                                                              SHA-512:D9DCB217F268862C577CACF4E9F84C63E02B647113D484338A74EB0B24FADD6D87B4E7A551DD1EF692BB38E44562BFF848982ACB62840D4F49F91A7751320E34
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......d...........N......................................`............`A........................................m.w.......x.d....p........}..H....................w.......................w.(.....d.@.............x.......w.@....................text.....d.......d................. ..`.rdata..D.....d.......d.............@..@.data.........y.......y.............@....pdata...H....}..J....}.............@..@.gxfg....-...........d..............@..@.retplne.....@...........................tls....B....P......................@..._RDATA.......`......................@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\af.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):533447
                                                                                                                                                                              Entropy (8bit):5.412080848029905
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:WEGL+ocurcdy6VGycsaja+H2Jyngae5Ig1eo0vMIlgL2pQ+FXZG2vt2pslFd5/51:W1+ozrc86VZBaja+H2Jyngae5Ig1eo0N
                                                                                                                                                                              MD5:D9BEC09B6C523DC3BCA9A81264B1BEED
                                                                                                                                                                              SHA1:EA4AE9DFF554C59994632F85AF25B36C049FB5B2
                                                                                                                                                                              SHA-256:0B5A45DE223CE8522CC296AF1E93477540EAA74867428307CC3A5CD21921B022
                                                                                                                                                                              SHA-512:6E7677F86F73EDFFB5D6162CA19BB7464465F0F485CE2971FB20AD3F57D9FAC56B7A21D378701F80E85FB185C3AF6A238F8C8707F5874BFFFFD79D881A54DD6E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.....j.....k.)...l.4...n.<...o.A...p.N...q.T...r.`...s.....t.....v.....w.....y.....z.\...|.....}.........................................................................#.....2.....C.....V...........A.......................c.........................................M.......................F.......................!.....o.......................c.................$.....y.................0.......................,.......................7 ..... ..... ..... ....h!.....!....."....1"....."....."....."....."....E#.....#.....#.....#.....$....@$...._$....h$.....$.....%....L%....[%.....%.....&....B&....R&.....&.....&.....'.....'....n'.....'.....'.....'....7(.....(.....(.....(....1).....).....).....)....Q*.....*.....*.....*....1+....s+.....+.....+.....,....U,....z,.....,.....-....]-.....-.....-....*.....h.......................I/....u/...../...../....A0....|0.....0....#1.....1.....1.....2....}2.....2.....3....=3.....3.....4....54....H4.....4.....4.....4.....5....e5.....5.....5

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\am.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):861015
                                                                                                                                                                              Entropy (8bit):4.906916579483596
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24576:HzD984ToH3hTCNRysrxQH9hjN3Rpzvh51muMXqVFq+XG/6WxLP5A:qn5N
                                                                                                                                                                              MD5:E3933DE22DC7FB98215B083D8A379F40
                                                                                                                                                                              SHA1:68DDBD9BCC931F0D4A172FA65AF35B823C7C9E37
                                                                                                                                                                              SHA-256:EAA747075E5A62BE8B7DF5908E167CCC5314C9C6A8B890059D00284A3C496FEF
                                                                                                                                                                              SHA-512:7BEB80FA029F41CB21536B15C604E2AE9DFC20B4A3EC4F5CC04E2B105D4B2C251830624957197084761F9686F95D332E25D4F6178509AD58257AF90D96A9E7D5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.%...j.1...k.@...l.K...n.S...o.X...p.e...q.k...r.w...s.....t.....v.....w.....y.E...z.s...|.....}.................................................&.....'.....(.....-.....I....._.......................`...................................6.................S...........E...........P.................x.................S ..... .....!.....!.....!....P".....".....".....#....^$.....$.....$.....%.....&....c&.....&.....'.....'.....(....A(.....(....{).....).....).....*.....+.....,....H,.....,.....-....C-....v-.....-....N................../....w/...../...../....u0.....1....y1.....1....@2.....2....03....F3.....3....c4.....4.....4...._5.....5....16....P6.....6....T7.....7.....7....`8.....9.....9.....9....0:.....:.....:.....;.....;.....;....6<....^<.....<....c=.....=.....=....{>.....>....b?.....?....*@.....@.....@.....@.....A.....B....RB....qB....,C.....C.....D....7D.....E.....E....TF....nF....9G.....G....NH.....H....LI.....I....`J.....J.....J....FK....lK.....K....8L.....L....6M

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\ar.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):943328
                                                                                                                                                                              Entropy (8bit):4.930661249056055
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:NYI8HRnwBUC/+/RYfESugvPUB6m7kOCSn5KNp5QpnSKU/:SNHRnh5aQM
                                                                                                                                                                              MD5:AC865FF462F341B4317C3D16EEB40460
                                                                                                                                                                              SHA1:1E971D97F09884B23595F17534227EA43CF99090
                                                                                                                                                                              SHA-256:0557BC17EB1D134BD52F203836551B55579114708E2DF51F653972951567513D
                                                                                                                                                                              SHA-512:A935B91A2C053303E941866CFC151F28053FAF364AEECE98D61FCD68FEF6C6F1D3B73DE01CD602C8A4A081CCE452D1CE87F8166BA3C0E8B81E91D932F84737F2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:........j(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.&...t.=...v.r...w.....y.....z.....|.....}.K.....t.....y.......................................................................L.....@.....#....................... .....|...........H...........m...........?...........L.....}.............................k............ ....) ..... ....a!.....!.....!....."....\#.....#.....#.....$.....%.... &....Q&.....&.....'.....'.....(.....(....l).....).....).....+.....+.....,.....,....p-.....-..........Y...........B/....u/...../.....0.....0.....0.....0.....1....Z2.....2.....2....h3.....3....,4....=4.....4....w5.....5.....5....q6.....6....57....L7.....7....W8.....8.....8....F9.....9....H:....e:.....:....d;.....;.....;....K<.....<.....<.....=....L>.....>.....>....U?.....?.....@....a@.....@....9A....\A....yA.....B.....B.....B.....C.....C.....C....KD....dD....lE....MF.....G.....G.....G....mH.....H.....H.....I.....J....EJ....\J.....J....%K....KK...._K.....L.....L....&M....HM.....M

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\bg.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):982837
                                                                                                                                                                              Entropy (8bit):4.669923863173967
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24576:MhQgWoOYLYyzQkECvUPVbKDks373ZAW3AAK1mVDLpv74umpjd2SI5IxuFsoGQXxQ:VgWoOYLYfYUPVbKDks373ZN3ApmVDLpw
                                                                                                                                                                              MD5:7C37C8C9B4215089B6C16D22838D256B
                                                                                                                                                                              SHA1:8F2AFDC21353685353A0562452F4A79180E58829
                                                                                                                                                                              SHA-256:2EBD582DFAA3139CD6A03E9892A94A3D9BB6936E0B04085B8F2D27E1DEC0BC8A
                                                                                                                                                                              SHA-512:BEADD70E9D706576BFB6725617385F776E9F68C84D116B01187354D377E2C860899DA34F8C5A054C4BDE41A57E9AAC56445F6AC0B8DA8C75A424641A86FDD718
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i."...j.....k.=...l.H...n.P...o.U...p.b...q.h...r.t...s.....t.....v.....w.....y.B...z.p...|.....}.................................................#.....$.....%.....*.....L.....e.............................$.....U.................9.....c...........p...........Z.....P.......................r ..... ....F!....l!.....".....".....".....#.....#.....$.....%....b%....^&.... '.....'.....'.....(.....)...."*....X*.... +.....+....5,...._,....K-......................./.....0....N1.....1....C2.....2.....3....)3.....3....\4.....4.....4....z5.....6....J6....p6....'7.....7.....8....E8.....8....n9.....9.....9....l:.....:....0;....P;.....;....a<.....<.....<....n=.....=....J>....r>....m?....S@.....@....-A.....A....^B.....B.....B...._C.....C.....D....gD....CE.....E....^F.....F.....G....3H.....H.....I.....I....NJ.....J.....J.....K....(L.....L.....L.....M....8N.....N.....N.....O.....P....XQ.....Q....}R....7S.....S.....S.....T....dU.....U.....U.....V.... W....kW.....W.....X....dY.....Y

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\bn.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1267393
                                                                                                                                                                              Entropy (8bit):4.284356072775859
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3072:LEcoGqGB2le1abaCb6Ew/0WySZIS+xd2f/MHDrYfHBpxspSPrCXqB+iBbHRI8T51:LjJfa56/0z5XpCOXqB+iBbD5YqNn
                                                                                                                                                                              MD5:FC66ADF3DEAC72FD39105540DD2DAEFF
                                                                                                                                                                              SHA1:A53B54EFCC1285A226D605116F87D12F69942482
                                                                                                                                                                              SHA-256:EF50CFEBAF9E32EDEEC25D30197AC5899B3DB8A0676671F639D32BC48F3B3BD8
                                                                                                                                                                              SHA-512:0B77DAA056451D01A8CFB3FF1ACC08D34E64E0A32BB119C8837AE3D6E3D5195311427C6101EFD7E7BC9104AA369832BB12AAB3D4080C00DC39EDC98B6C0B949E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.....j.....k.....l.#...n.+...o.1...p.>...q.D...r.P...s.....t.....v.....w.....y.....z.L...|.s...}...............................................................................0.....U.....................................................?.......................Z.................. ..... ....(!.....!.....".....#....N#.....$.....$.....%....+%....R&....0'.....'.....(.....).....)....^*.....*.....+....~,.....-....1-.....-.........../....E/....@0....*1.....1.....1.....3.....4.....4.....5.....5....k6.....6.....6.....7.....8....`8.....8.....9.....9.....9.....:.....:.....;.....;....:<.....<.....=.....=.... >.....>....{?.....?.....?.....@....9A.....A.....A....XB.....B....LC....rC.....D.....E....{F.....F.....G.....H.....I....QI.....I....sJ.....J.....J.....K....iL.....L.....M.....M.....N....^O.....O.....P....#Q....oQ.....Q.....R....5S.....S.....S.....T....{U....#V....\V.....W.....X.....Y.....Z....@[....B\.....\....L].....^.....^....W_....._....]`....$a.....a.....a.....b.....c

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\ca.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):598934
                                                                                                                                                                              Entropy (8bit):5.408962543645936
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:gVHfWsqPdf9nwWF47D1MeCi24b3Fe5PFFuN3Mw2juwHzejm0t3l3kb7TenzL8wOs:gV/WRdlnPyToiL6YhgMNxgCh5cxSas
                                                                                                                                                                              MD5:E1AC7F4C28177F68FAC3BE2375A9368C
                                                                                                                                                                              SHA1:3D7738699087468A748F9B1189D2F7621187D03B
                                                                                                                                                                              SHA-256:EFA1BA906F8ABCE91EBB9D6442B64E0D5AE7DAB78DDA8A49A6FED1A342C71B9B
                                                                                                                                                                              SHA-512:AEE8CB28EB02E2FB2155C8D093CF678284E3571F46B913F743DE3C6D0215C18B80866FF446F46ADA160860ED9C18AE9A4209424E7E0F0BA97C78A3FE9815CA5A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.....j.....k.!...l.,...n.4...o.9...p.F...q.L...r.X...s.....t.....v.....w.....y.&...z.T...|.{...}.........................................................................%.....>.....^.....|.......................7.................S.....l.............................m.......................v.......................k...................................2.....`...........R.................- ..... ..... ..... ....I!.....!.....!.....!....c".....".....#....,#.....#....L$.....$.....$....3%.....%.....%.....%.....&....i&.....&.....&.....&....N'....{'.....'.....'....\(.....(.....(.....)....b).....).....).....)....H*....s*.....*.....*.....+....I+....V+.....+.....,....A,....R,.....,....D-.....-.....-..........\................../....L/....o/...../.....0....S0....h0.....0....N1.....1.....1....+2....r2.....2.....2.....3....^3.....3.....3.....4....c4.....4.....4....b5.....5....\6....w6.....6....c7.....7.....7....I8.....8.....8.....8....@9.....9.....9.....9....9:.....:.....:.....:

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\cs.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):616994
                                                                                                                                                                              Entropy (8bit):5.843791316218894
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:863oqX0hmR4QkWA9jN85ASh6mARAO52C+wH/NOKbJSBXR8QQ:VYPNB85AS0P52C+wH/NOeJS+
                                                                                                                                                                              MD5:92E3FD1EB47767A0CB5F6E734DE4EEC1
                                                                                                                                                                              SHA1:33053BFEAD1FA67160B6A3C417EC4559BFDCDCFB
                                                                                                                                                                              SHA-256:D269E16FBD9B2AFE95B148ECE22B2AC803768FB53EE42E1FAD0181F9DEC84544
                                                                                                                                                                              SHA-512:916D73D9B28B0600878418A06388C2ED61BFAF17807A16E1C157A30E5DA136C6B6F194E99D151C43B9AA35D101DE755CAA6DA69E1C8A50DD134F27A7F2ADC016
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.....j.....k.....l.....n.....o.....p.&...q.,...r.8...s.g...t.~...v.....w.....y.....z.4...|.[...}...........................................................................................4...........^.................<.......................i...........A.....Z...........?.....{.................U.......................D.....l.................T.................:.................+............ ....K ....c ..... ....6!....k!....{!.....!....k"....."....."....:#.....#.....#.....$....u$.....$.....$.....$....N%.....%.....%.....%..../&.....&.....&.....&.....'.....'.....'.....'....2(.....(.....(.....(....-).....).....).....)...."*.....*.....*.....*....:+.....+.....+.....+....f,.....,....)-....@-.....-.....-.....-..........Q.......................W/...../...../...../....]0.....0.....1....I1.....1.....1.....2.....2.....2.....3....13....F3.....3.... 4....a4....y4.....4....g5.....5.....5....E6.....6.....7....77.....7.....8....D8....Y8.....8.....9....49....H9.....9....":....\:

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\da.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):558889
                                                                                                                                                                              Entropy (8bit):5.449151445338137
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:Gqv1aOSLABh3359zVmh5OsfZh1seDrwwlQJWJwgIobwmPaHL95bpkUdRi3jd4xFm:GqonsMfPrWb55bpfddm
                                                                                                                                                                              MD5:43029018648D558F9BBF7A74C59EB281
                                                                                                                                                                              SHA1:90C6618CCCB4DB85D7485AE8D809EC3AF4763E70
                                                                                                                                                                              SHA-256:4BD88F6AB82842358987AAD384775B35198DD75C2CCE4CAE783208ED69296A7E
                                                                                                                                                                              SHA-512:9E8EF9D4367AD01F2F4E7DD6F9884E463729EE5A0F678FD16A3CE093C21EFC1D78041D5C6E45037F37BFD732E4833744485B00ACFDA2313A1D1E947993129A3D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.+...j.7...k.F...l.Q...n.Y...o.^...p.k...q.q...r.}...s.....t.....v.....w.$...y.K...z.y...|.....}...........................................%.....,.....-...........0.....>.....N.....b.....{...........`.................!.......................l...........A.....]...........-.....].....q........... .....G.....T.................2.....@.................8.....R...........>.....z.................w.................. ..... ..... ..... ....l!.....!....@"....Z"....."....s#.....#.....#....A$.....$.....$.....$....(%.....%.....%.....%.....&....Z&....~&.....&.....&....R'.....'.....'.....'....W(.....(.....(.....(....K)....v).....).....)....**....P*....Z*.....*.....+....@+....N+.....+....I,.....,.....,.....-...._-.....-.....-.....-....<.....Z.....r............/....6/....F/...../.....0....h0.....0.....0....W1....|1.....1.....1....b2.....2.....2.....3....T3.....3.....3.....4.....4.....4.....4....q5.....5.....6....N6.....6.....7....J7....\7.....7.....7.....8.....8.....8.....8.....9

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\de.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):596603
                                                                                                                                                                              Entropy (8bit):5.5059525736264
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:55U5D5aDs3K7UpGg5aL9Xtt5fPMkUz1CTz:5eaDs3K7UpGg5aLRf53MtCTz
                                                                                                                                                                              MD5:3A8DE004B3A610271E1D1913B6D4B53B
                                                                                                                                                                              SHA1:236893C3F7B450E6AD8B4D54E1A62B2E635B42D6
                                                                                                                                                                              SHA-256:43C060182C92CAF4AEBF8FD7B913DFE017BEEA71E796E862EBF8746575948364
                                                                                                                                                                              SHA-512:B70F849CCF7DD9E72D71522591420E0BAA03FF74763B44563B0B3800BA3A88CB8B973FABB90BBB6653819947ECA47F70E347958E3C31AB226957F7313BC03554
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:........((C.e.....h.....i.'...j.3...k.B...l.M...n.U...o.Z...p.g...q.m...r.y...s.....t.....v.....w. ...y.G...z.u...|.....}...........................................!.....(.....).....*.....,.....=.....P.....b.....x.....2...........J....._...........b.................?...................................?.....W...........B.....p.................k.................:.............................'.....c............ ..... ..... ..... ....O!.....!....."....#"....."....O#.....#.....#....]$.....$....Q%....p%.....%....O&....q&.....&.....&....^'.....'.....'.....(....p(.....(.....(....1).....).....).....*.....*.....+....7+....G+.....+.....,....a,....r,.....,....W-.....-.....-............................j/.....0....W0....m0.....0....J1....l1.....1.....1....62....S2....f2.....2....93....b3....u3.....4.....4.....4.....4...._5.....5.....5.....5....q6.....6.....7.... 7.....7.....8....X8....n8.....8....|9.....9.....9....i:.....:....);....V;.....;....?<....l<.....<.....<....U=....~=.....=.....>.....>.....>

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\el.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1076241
                                                                                                                                                                              Entropy (8bit):4.759988949622547
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24576:yvHcaFbu4FDYX9QCMDhWJXDsS7miHk3D2NpYRDojvmXgVT8y2IWYNQKlCt2rDQur:aHcaFbu4FDYX9QCMDhWJXDsS7miHcD2r
                                                                                                                                                                              MD5:58D6EAF71B9B73F5F7F057C73D0D92EC
                                                                                                                                                                              SHA1:16E0587753E7D2834F4CBB24FED45E7BD2F8F2F4
                                                                                                                                                                              SHA-256:8474879DE21C414D34C44CF0A8C91356A66DBD647308A4F994BE25BD1F93A89F
                                                                                                                                                                              SHA-512:AB24C9655BD68E4A64E257914A35DC84B5F791C58B396AE004BF5DA61DF19C02EF9CA572B8E63F15BAF3694AE1E540ADF74586F10D28D7EF90EDEEC982BCF28D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.....j.....k.....l.(...n.0...o.5...p.B...q.H...r.T...s.....t.....v.....w.....y."...z.P...|.w...}...............................................................................S...........................................................T.....\.....0.................1...........F ..... ....C!.....!....)"....J"....."....~#.....#.....#.....$.....%.....%.....&.....'.....(.....(.....(.....)....t*.....*.....+.....+.....,....'-....R-....C............/...../.....0.....1.....2.....2....~3..../4....{4.....4....R5.....6....H6....m6.....7.....7.....8....<8.....9.....9....]:.....:....Q;.....<.....<.....<....y=....O>.....>.....>.....?....Y@.....@.....@.....A....QB.....B.....B.....C.....D....wE.....E....|F....DG.....G.....G....}H.....I....<I....XI.....J.....J.....K....0K.....L.....L....YM.....M....VN.....O....<O....cO.....P.....P....NQ.....Q....kR.....S.....S.....S.....T.....V.....V.....W.....X.....X....dY.....Y.....Z.....[....7\....h\....#].....]....W^....y^....._....z`.....`

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\en-GB.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):485863
                                                                                                                                                                              Entropy (8bit):5.521699894815275
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:Ll+Npdwk8sj7ahcbKdFk+ufMP9ezQSKrfaYdrcLlY5IPxZBcvRJ+G:Ll++143fMuQSK3Z5MxLG
                                                                                                                                                                              MD5:985558DE03BF486AEC1DAADD39CB508D
                                                                                                                                                                              SHA1:B693DDEF983E8AF212936202DDCA92D908378404
                                                                                                                                                                              SHA-256:1956D448A4D333638F3601D0DA976710CBE0A795504EB694BA18311FE586D195
                                                                                                                                                                              SHA-512:13D1C82B797AD4FF25A94A996F9FB52B530643A0E735F96E32B9E0698962770148D95DB7BEB91343D781FB84378A3E334AC0C1C913D8DBAE20F425BF0DC364D3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........)d.e.....h.....i.....j.....k.....l.....n.....o.....p."...q.(...r.4...s.c...t.z...v.....w.....y.....z.0...|.W...}...........................................................................................'.................E.....Y.......................>.................:.....P.................$.....9.............................K.............................Y.....~.................L.......................:.....k.....y.................;.....K.................. ..... ..... ..... ....!!....5!....t!.....!.....!.....!....."....N"....m"....w".....".....".....#....##....}#.....#.....#.....$....^$.....$.....$.....$....)%....n%.....%.....%.....%.....&....V&....a&.....&.....&.....'....#'.....'.....'.....(.....(....|(.....(.....(.....(....>)....z).....).....).....)....>*...._*....n*.....*.....+....G+....m+.....+.....+.....,.....,....q,.....,.....,.....,....`-.....-.....-.....-....[............/...../...../...../.....0....-0.....0.....0.....0.....1....Q1.....1.....1.....1.... 2....m2.....2

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\en-US.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):490357
                                                                                                                                                                              Entropy (8bit):5.513411409378336
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:1kdXRDCwszpReMP9e0QcD2faYjNCu454ZxDng/t/XFLwB:1sUwGeM1QcDq+5UxOLwB
                                                                                                                                                                              MD5:752A3FEED3AB6C127767C8FABC9A40B6
                                                                                                                                                                              SHA1:4AF9F9C19904D3BEF154B469858DC44B1E630A75
                                                                                                                                                                              SHA-256:C6A6C5D7AB6119BBA712D6FE45FD385506D4D0DD8E4156CCA3925062F4502AC5
                                                                                                                                                                              SHA-512:AE96D4F391E36F8F741671B72EBD4B1AB2D049B2A99B95737FB9F81743B9E414B46022B65194AF5616EB354056ADDF0E46EF090F56B7D945EF2CB5F4D100D64F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:........O)..e.\...h.d...i.l...j.x...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.9...w.e...y.....z.....|.....}.......;.....@.....H.....P.....X....._.....f.....m.....n.....o.....t.............................#.......................;.......................0.......................3.....~.......................S.....|.......................=.....J.............................z.......................l.......................H........................ ....^ ..... ..... .....!....^!.....!.....!.....!....*"....E"....T"....."....."....."....."....8#....u#.....#.....#.....#....J$....|$.....$.....$....&%....S%...._%.....%.....%.....&....!&....i&.....&.....&.....&....)'....n'.....'.....'.....(....](.....(.....(.....(....=)....`)....v).....).....).....*....1*.....*.....*.....*.....*....P+.....+.....+.....+....7,....n,.....,.....,.....,....7-....a-....q-.....-..........N.....f...........7/...../...../...../....J0.....0.....0.....0....@1....l1....{1.....1.....2...."2....22.....2.....2.....3

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\es-419.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):589663
                                                                                                                                                                              Entropy (8bit):5.378608358697393
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:cv+c/pQ8eguGEy1mVpDYl7G8oZOZ5zazaQ+ax891:cP3RsJpuGS5za9+D1
                                                                                                                                                                              MD5:85E9B056E3AC3F6A5B113ED9F460E202
                                                                                                                                                                              SHA1:DCCEEF6EA85D71A85DD24D17EC65371DCE76F480
                                                                                                                                                                              SHA-256:16FE83762ED578C49685868418325920A72CD457907BC4E5264F2C172D53B27B
                                                                                                                                                                              SHA-512:E4DFDE9C1260DF1F77B7EC1797658F8CFEAAB98142A8D512ED3BFAC054933A4583F20091B97985B4BA9CF93F9FACA3E7B0986CB4A3EB12FE0BC04EE1C45D3E0F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.....j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.?...z.m...|.....}................................................. .....!.....".....$.....6.....E.....Z.....q.......................$.................A.....Y...........i.................`.................2.............................r...................................H.....x...........n.................P ..... .....!.....!.....!.....!....'"....>"....."....*#....r#.....#....%$.....$.....$....$%....v%.....%.....%.....&....[&.....&.....&.....&....R'.....'.....'.....'....l(.....(.....)....0).....).....)....2*....>*.....*.....*.....+....&+....x+.....+.....+.....,....p,.....,.....-....'-.....-..........f.................A/....p/...../...../....C0....j0.....0....41....j1....z1.....2....o2.....2.....2...._3.....3.....3.....3....U4.....4.....4.....4....y5.....5.....6.....6.....6....C7.....7.....7....N8.....8.....9....;9.....9....!:....e:....y:.....:.....;....5;....H;.....;....9<.....<.....<

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\es.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):589284
                                                                                                                                                                              Entropy (8bit):5.3587509940363995
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:Uxb0Q3M9BnWhau1WK4G0gkjqpT+ZbBQihXFijs5J+f2D//z/h6PZOkx:SAwx4Lep4BQiXijs5k2r/Lzk
                                                                                                                                                                              MD5:3DB06EA954C83343BD333C15947F521A
                                                                                                                                                                              SHA1:DDDE6AB9F9085E83EC8BF7A37DF3389040ACEA42
                                                                                                                                                                              SHA-256:45DF7340FE3C8560B11FFBA2219DE1B5C45DBFE57B6DB90BD6C246244FAE338A
                                                                                                                                                                              SHA-512:CC29F1075C119DADDAA108C17ABB6D572925CAC1ED2237ED2FD45364BFB2A00C1144FCCDD22C6728C954AF2CDD1B9477F39968BA25354BCA2B9DCA07F5C53DDE
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h."...i.*...j.6...k.E...l.P...n.X...o.]...p.j...q.p...r.|...s.....t.....v.....w.#...y.J...z.x...|.....}...........................................$.....+.....,.....-...../.....B.....R.....g.............................2.................Z.....p.............................}...........).....D.......................>.................(.....9...........3.....x...........'.......................k ..... .....!....*!.....!.....!....6"....K"....."....?#.....#.....#....7$.....$.....$.... %.....%.....%.....&.....&....t&.....&.....&.....'....f'.....'.....'.....(.....(.....(.....)....")....{).....).....*.....*....k*.....*.....*.....+....R+.....+.....+.....+....I,.....,.....,.....,....X-.....-............................./....-/...../...../.....0....$0.....0.....1....01....C1.....1....82.....2.....2.....3....i3.....3.....3.....4....g4.....4.....4....'5....w5.....5.....5....m6.....6....Q7....h7.....7....u8.....8.....8....g9.....9.....:....%:....w:.....:.....:.....;....l;.....;.....<

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\et.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):536344
                                                                                                                                                                              Entropy (8bit):5.456021867812121
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:HeaF27VNhXV9R5OJs99Z0+I+eL40dmFZxEYTHbtiPSia6OSt75H50MHsjiCKM2a6:HhFEVN53Q6Z8+wmFZq0SfH50MIW
                                                                                                                                                                              MD5:8E2C2CC8C516D8B7181C0C712CA24513
                                                                                                                                                                              SHA1:E0CCD9ED8DE6640379F822A067DCF97D4BBE44A7
                                                                                                                                                                              SHA-256:C96937F46FB1B1182B201F5C48FE1DA4D3F94A68A0E6E0699CCC0944CD0A5A33
                                                                                                                                                                              SHA-512:339BC655F22068F2EE9352A670325865265E4279197430214F7E3FBA575415318110CCCB03AED2C0E7AC673D4629BD495DC34A56CEFBCAAB62E1C4A1A87ED8C2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.2...h.:...i.K...j.W...k.f...l.q...n.y...o.~...p.....q.....r.....s.....t.....v.....w.D...y.k...z.....|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P.....`.....r...................................$.................#.....6.................U.....k...........4.....d.....v...........,.....Y.....d.................F.....Y.................C.....a...........?.....z.................^.......................f ..... ..... .....!....r!.....!.....!....7".....".....".....#....p#.....#.....#.....$....^$.....$.....$.....$....>%.....%.....%.....%....6&.....&.....&.....&....B'.....'.....'.....'....L(.....(.....(.....(....C).....).....).....)....C*.....*.....*.....*....\+.....+.....,....&,....y,.....,.....,.....-....j-.....-.....-..........d................../....f/...../...../....(0....t0.....0.....0.....0....Y1.....1.....1.....1....g2.....2.....2.....3.....3.....4....f4....z4.....5.....5.....5.....5....Z6.....6.....6.....7....\7.....7.....7.....7....>8.....8.....8

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\fa.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):876080
                                                                                                                                                                              Entropy (8bit):5.051372514206481
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24576:nrL8u313uyqoT+seqyRmX5loTUOmdAQifaQ2XxFMJGk62YhYaiiIQMX4qOwUCMdq:ng56I
                                                                                                                                                                              MD5:CAEE902136579F4BAC72A6F0F75D171B
                                                                                                                                                                              SHA1:CBBAF988A499005E21FD86652E1F48AF8BCE2C35
                                                                                                                                                                              SHA-256:E86F677E9654F6A16A7738E85A5A5D467A09CB18E47654F079506A00AFFAD70C
                                                                                                                                                                              SHA-512:C0F2E8457F71789DA8CE207AAAE2F83196DAAC868FCAA7A84DE04DD38730F8831B9643B8A404A7AA59C5B726DA02090BBA414529019F5EB9C94AC5A5AF61BC9D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:........R(..e.b...h.j...i.u...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.B...w.n...y.....z.....|.....}.......D.....I.....Q.....Y.....a.....h.....o.....v.....x.....}...............................................>....................... .................'.....P.................%.....L...................................$ ....n ..... ....4!.....!....."....=".....".....#.....#.....$.....$....G%.....%.....%....I&.....&....7'....U'.....(.....(....4)....V)....'*.....*....u+.....+.....,.....,.....,.....,....w-..........;.....L...........l/...../...../....\0.....0....L1....a1.....1.....2.....2.....2....i3.....3..../4....B4.....4....^5.....5.....5....K6.....6....-7....>7.....7.....8.....8.....9.....9.....:....I:....l:.....;.....;.....;....1<.....<....Z=.....=.....=.....>....(?....z?.....?....?@.....@.....@.....@.....A....WB.....B.....B....qC.....D....OD....pD....nE....fF.....G....-G.....G.....H.....H....$I.....I.....J.....J.....J....~K.....K....&L....GL.....L.....M.....M.....N

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\fi.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):547257
                                                                                                                                                                              Entropy (8bit):5.425790227406111
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:sXTpn19l5MtWuah5EinUtWnSp0WahHNYM:yTlB5E8nRl
                                                                                                                                                                              MD5:125A121C22DFC2B1A1C759CAD9123E42
                                                                                                                                                                              SHA1:D0282AF9EC311C406ECCCDFDD7216B7D883E94C3
                                                                                                                                                                              SHA-256:B733460F039DCB3795077BA91DAFA3B9B8163DFD0F15168B250630F7DE21ED0A
                                                                                                                                                                              SHA-512:C6E0EA8FAB8115A632D4C74141EFC46EA546F43E0B806D5BD95A1ECD3B8FE37A44565A2F79C43E0BC50DBDADC5D16054E07485FAD83C99BD3550A907C852E724
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:........F(%.e.J...h.R...i.c...j.o...k.~...l.....n.....o.....p.....q.....r.....s.....t.....v.0...w.\...y.....z.....|.....}.......2.....7.....?.....G.....O.....V.....].....d.....e.....f.....k.....}.......................@.................$.......................0.................G.....]...........1.....d.....y...........&.....S.....a.......................'.........................................8.....R.................0.....F.................5.....J............ ....8 ....V ..... ....@!.....!.....!.....!....K"....n".....".....".....#....A#....O#.....#.....#.....$....'$....w$.....$.....$.....$....V%.....%.....%.....%....;&.....&.....&.....&.....'....n'.....'.....'.....'....M(....v(.....(.....(....`).....).....).....*....R*....n*.....*.....*....2+....T+....m+.....+....0,....T,....c,.....,..../-....f-.....-.....-........../.....>................../....1/...../...../....&0....@0.....0....C1.....1.....1.....2....q2.....2.....2....$3....|3.....3.....3.....3....A4....Z4....j4.....4.....5....I5

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\fil.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):618874
                                                                                                                                                                              Entropy (8bit):5.2024833562888055
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:fGsQ2sSp+ynDQmiSANIhxp3amx5GhV7MQoE8AYzwK:fiolx5G7s
                                                                                                                                                                              MD5:EAF43729E9BBD8004EF1FF56A3D85A48
                                                                                                                                                                              SHA1:34B31AB8EA2CE6BD263F00ACC50D5AF8D0222D9A
                                                                                                                                                                              SHA-256:8559CC35335BB2C249297F4C7506DF95CEF899EF5F7AD942D2D511AE074D41B0
                                                                                                                                                                              SHA-512:010F8E5C3B969BE0DB4BAEC3ACFFDD69BE25662387968E15E11AF0DA68EC2F45DC9EDB83CAFE7C92234E1E4E4AAE1682223235AF04D99E8B5238379E022E3D35
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:........*)A.e.....h.....i.0...j.<...k.K...l.V...n.^...o.c...p.p...q.v...r.....s.....t.....v.....w.)...y.P...z.~...|.....}.....................................#.....*.....1.....2.....3.....8.....E.....Z.....p.........../........... .....:...........1.....v...........3........... .....G...........<.......................`.......................s.................J.................* ..... ....@!.....!.....!..../".....".....".....#....~#.....#....*$....D$.....$....?%.....%.....%....8&.....&....$'....F'.....'.....(....0(....M(.....(.....(....#)....0).....).....).....*.....*.....*.....*....5+....K+.....+.....,....M,....\,.....,.....-....Q-...._-.....-.... .....Q....._..........."/....T/....b/...../....c0.....0.....0....41.....1.....1.....1.....2.....2.....2.....2.....3....}3.....3.....3....G4.....4.....5....75.....5.....5....(6....B6.....6.... 7....S7....n7.....7....b8.....8.....8....k9.....:....n:.....:.....;.....;.....;.....<.....<.....<....,=....D=.....=.....=....$>....:>.....>....0?....l?

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\fr.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):637414
                                                                                                                                                                              Entropy (8bit):5.391270599351283
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:ZPM7ZL85Z4p5ZR6QuaMVq0YzRnP4ZoZCMYnYyGGGDYQzc7IvO8Ixat40wCSsmlFI:ZPiYVW45F2
                                                                                                                                                                              MD5:651E4CB14C4F784D36D0A1715C52DCF3
                                                                                                                                                                              SHA1:540F6090E3223AD8E6424A9DB78305F2DB9974BF
                                                                                                                                                                              SHA-256:6D547CBC3304627D14AEB138AEBD40786C30A4192E071D80BCECDB77A13AC80A
                                                                                                                                                                              SHA-512:1FE93058EC434C06EF4AA1519333EBD831311971B06D7279DDC4D86DFA860BBD6EA6D127B2A07425C3E78BD6D41C11EB2A76CF25B20C6A7DE74D1F0CEEC87079
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.....j.....k.....l.....n.....o."...p./...q.5...r.A...s.p...t.....v.....w.....y.....z.=...|.d...}.....................................................................................$.....3...........{.................u...........*.....B...........`.................H.................+.........................................*.....?...........4.....w...........&.......................b ..... .....!....&!.....!.....!....;"....N"....."....9#....{#.....#....($.....$.....%....4%.....%.....%....*&....A&.....&.....&.....'..../'.....'.....'..../(....A(.....(.....)....G)...._).....)....(*....\*....q*.....*....#+....O+....]+.....+.....,....<,....K,.....,.....-....A-....U-.....-....X.................7/...../...../...../....)0....{0.....0.....0.....1.....1.....1.....1....s2.....2.....3....i3.....3.....4.....4....D4.....4....05....l5.....5.....6....t6.....6.....6....c7.....7....48....G8.....8....99....~9.....9....1:.....:.....:.....;....q;.....;.....;.....<.....<.....<....7=

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\gu.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1247969
                                                                                                                                                                              Entropy (8bit):4.3234098874611675
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3072:dYXCzHrul8BRuh7x4kvm/RbIwjAwREJKVMjNiT7llj63rFulPCaSi5NAWsWi//Go:SgruQuhd4kOv0wv5qdhX11oG
                                                                                                                                                                              MD5:6C949199EAAAD8FCB12C38EC6C02D758
                                                                                                                                                                              SHA1:CE4DBD5E6A37F25354EC6849F7008956EF3568BA
                                                                                                                                                                              SHA-256:966591A74E44C75C7F0114BB8E36B0E9F5502AEBDC96C714C8A8F6D45BC863C8
                                                                                                                                                                              SHA-512:3344E0083969DE6F4913893A14586B441F65CB5D45F913F1CEA61B8D5ABBDB3B1C18A48731870282174263C1F306ED6B99C279627BD269E89CD4E15DC3D88313
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.....j.....k.)...l.4...n.<...o.A...p.N...q.T...r.`...s.....t.....v.....w.....y.....z.\...|.....}.........................................................................8.....]......................."...........B.....5...........y.......................p.................7 ..... ..... .....!....."....h"....."....H#.....#....2$....R$....5%.....%....P&.....&.....'.....(....,)....n)....D*.....+.....+.....+.....,....k-.....-.........../.....0.....0.....0.....1.....2.....3.....3....q4.....5....F5....m5....&6.....6.....7....C7.....7.....8.....8.....8.....9....s:.....:.....;.....;....|<.....<.....<.....=....S>.....>.....>....g?.....@....n@.....@....@A.....A....KB....jB....}C.....D....2E....hE....!F.....F....(G....QG.....G....VH.....H.....H....WI....8J.....J.....J.....K.....L....JM.....M....oN.....O....RO.....O....gP....-Q.....Q.....Q.....R....zS.....T....<T....cU.....V....^W.....W.....X.....Y.....Z....fZ....R[.....\.....\.....\.....]....I^.....^.....^....._.....`....ta

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\he.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):769483
                                                                                                                                                                              Entropy (8bit):4.624517967326664
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:HwRkrhVzCDkVF2TWrqnV3mWqu/rHQxssACnX+8eQCajZ5Q69Zt+yr4w5ONmmEkcU:QU5J+f
                                                                                                                                                                              MD5:16562C59FBA469E1DD2F3B0B87A64645
                                                                                                                                                                              SHA1:9A6863205FCA8EA6D09A98B8E8DAB543FF6198A1
                                                                                                                                                                              SHA-256:64FA2E98A9056E23C3A934FF39FEF81C306CEC5844D56DDA17EC6C25FCDB1B5A
                                                                                                                                                                              SHA-512:DBB6E1A5E52A005386007F88B53109037792BC7B65FB95ACE3E8CC5AE3EBD8320C7E406381C375BF751A9265ACE84E0BBE1301D4BF3AA79200EC789DC3B3BC0B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.F...t.]...v.....w.....y.....z.....|.:...}.k.........................................................................................0.................(.....J...........H................._...........R.....r...........z.................p.........../.....@...........#.....R.....t...........o.................v ..... ....D!....h!.....".....".....".....#.....#.....#....=$....T$.....$....Y%.....%.....%....|&.....'.....'.....'....2(.....(.....(.....(....m).....).....*.... *.....*....<+.....+.....+....&,.....,.....,.....,....n-.....-....".....7............/....X/....i/...../....Q0.....0.....0.....1.....1.....1.....1....|2.....3....T3....s3.....3....[4.....4.....4....%5.....5.....5.....5....^6.....6.....7....67.....7....I8.....8.....8....>9.....9.....9.....9....R:.....:.....:.....:.....;.....<....d<.....<....\=.....>.....>.....>....X?.....?.....@....P@.....@.....A.....A.....A....wB.....B.....C....3C.....C....vD.....D

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\hi.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1316094
                                                                                                                                                                              Entropy (8bit):4.298990624339052
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3072:Pk/xu63zEz67Esk0GjV/BB0ZV1dKu4lYvD6OEOTByntDPtDlZpfRQhs4fe/8bR8E:8/xt3zEMEn0WXo5CKMhZQ
                                                                                                                                                                              MD5:6AA92C296ED09FE2AA94DC060B25774A
                                                                                                                                                                              SHA1:7619ED3DC5B1E04C55B0EE7280AC2D0135EB9C80
                                                                                                                                                                              SHA-256:0C771C66DB4F80A62912564944C4E239F8DAC8381A06483ECAB512E0D75744A1
                                                                                                                                                                              SHA-512:9255A4FFEF7BE07CEAB5DD8F46365B9A52D621AE175C1022BB4685FE4F3EA63425F45AA9EF824B467B9C33C51A7104258E888E8EC15C88FEA126BF0B5337FF14
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:........_(..e.|...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.-...v.b...w.....y.....z.....|.....}.;.....d.....i.....q.....y.................................................................E.....~...........X.................v...........;.....i...........x.................. .....!....N!....!"....."..../#...._#.....$.....$.....%....5%.....&.....&.....'....\'.....(....e).....).....*.....*.....+....',....P,....7-.....-....e............/.....0.....1....O1.....2.....3....L4.....4....`5.....6....f6.....6....J7.....7....N8....y8.....9.....9.....9.....9.....:.....;.....;....,<.....<.....=.....=.....>.....>....{?.....?.....?.....@....;A.....A.....A....cB.....C....uC.....C.....D.....E....%F....UF.....G.....G.....H....5H.....H....QI.....I.....I....iJ.....K.....K.....K.....L....ZM.....M....4N.....N....zO.....O.....O.....P.....Q....TR.....R.....S....:T.....T.....U....qV.....W.....X.....X.....Y.....Z....$[....f[.....\.....].....^....m^....a_.....`.....`.....`.....a.....b.....c

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\hr.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):594999
                                                                                                                                                                              Entropy (8bit):5.5194556553046565
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:ISmsqAZ/pqidI7/Rw6GhT0ww57V9YMrbLPDK:ISm/iEidI7/Rw6q0B5jYAzK
                                                                                                                                                                              MD5:FDA338824B4171B10DCC3395A549FA9F
                                                                                                                                                                              SHA1:EA42C8B18228E0CA57B8ED7ED48E3A2AEBE08486
                                                                                                                                                                              SHA-256:43F370368B322CD1236632C82AA0E231965DC58FDD497F8AEAE6B40EEF9EE611
                                                                                                                                                                              SHA-512:9115F805F51F45839E0A87CF44C1CCE311CECAF717C0DA7DB3B6DA85CEA95F24638AF29DA43BC01056994B22049DAA0387CD4371C13B8E5399FE8F4E38771D57
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.$...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...q.....r.....s.....t.....v.....w.6...y.]...z.....|.....}.........................!.....).....0.....7.....>.....?.....@.....B.....N.....Z.....h.....y.......................#.................'.....<...........3.......................s.................".............................f.......................r.................O.................<............ ....L ....d ..... ....(!...._!....s!.....!....["....."....."....U#.....#....B$....e$.....$.....%....:%....V%.....%.....%.....&.... &....f&.....&.....&.....&....D'.....'.....'.....'....H(.....(.....(.....(....G).....).....).....)....H*.....*.....*.....*....,+.....+.....+.....+....<,.....,.....,.....-....j-.....-.....-.....-....T.......................2/...../...../...../....F0.....0.....0.....1....{1.....1.....1.....2....v2.....2.....3.....3.....3.....3....P4....m4.....4....y5.....5.....5....b6.....6.....7....-7.....7.....7.....8....08.....8.....8.....8.....8....j9.....9.....:

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\hu.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):640919
                                                                                                                                                                              Entropy (8bit):5.644940180075165
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:oeo/GHgmRXxhsRd9gHo2pKJDAxukitluTd5kt8zZ9pwJcYNV9SLg+4ev6DbnjDiw:Ho/GBwHAZd5kt8Ex9y+O5LG9b
                                                                                                                                                                              MD5:7ADD28FBBBA1CE87972F6433862DCBAA
                                                                                                                                                                              SHA1:8B4B0053663C0B69BECA59FACA79854A89AB9C97
                                                                                                                                                                              SHA-256:DD86976D72F3CB644B90C1863E29E2F8616B09AC4ACFE9301FB346FA0D87BD78
                                                                                                                                                                              SHA-512:EFED0891B0202BAE9396DF54F141A73BB6CCADD7947330FD9E6A3A8911E9E037454238C4BD2BB9075AF3218230C9E4E394F83A70878396911FAA282D99FDD884
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.D...t.[...v.....w.....y.....z.....|.8...}.i.....................................................................................................~.............................L....._...........c................._.................'.................(.....9.................H.....i...........i.................s...........X ....| ..... ....b!.....!.....!....!"....."....."....."....s#.....#....6$....P$.....$....s%.....%.....%....\&.....&.....'....-'.....'.....(....,(....D(.....(.....)....G)...._).....).....*.....*.....*....U+.....+....+,....A,.....,....L-.....-.....-............................Z/...../.....0....B0.....0....W1.....1.....1....#2.....2.....2.....2....J3.....3.....3.....3....`4.....4.....5.....5.....5.....6....i6.....6.....7....U7....y7.....7.....7....T8.....8.....8....(9.....9.....9.....9.....:....,;.....;.....;....R<.....<...."=....V=.....=....e>.....>.....>....8?.....?.....?.....?....q@.....@....'A

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\id.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):529383
                                                                                                                                                                              Entropy (8bit):5.3800306514954634
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:MB38e1B6x8b+tQqAHcAef+eVnjHF/TmiZAWO5AVpWOBhUnNiT8kLHp:MB38erqPA2VnjHFbm8At5AVpLp
                                                                                                                                                                              MD5:CFC848689A25F5E2E6BA9A06E09B6EE0
                                                                                                                                                                              SHA1:35131E775D98A57FFCBD6A75E69F6F67437636C3
                                                                                                                                                                              SHA-256:EC1D7BBE064656DC53F70E3A612A582F5D5D0AF5F0C2D6A783796CFFA5BF7F57
                                                                                                                                                                              SHA-512:D5A027E35DD3846F5255B81EED36A3498AC9D809367692B2DA216B5771C2D54FAD35FC15C15705A2BBB4A7B35DD2245661882734998F9BC3AD8D62D2273B6577
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.....j.....k.(...l.3...n.;...o.@...p.M...q.S...r._...s.....t.....v.....w.....y.-...z.[...|.....}......................................................................... .....-.....=.....O...........5.....}.................6.....c.....o...........6.....y.................P.......................K.....{.......................=.....T.................B.....f.................P.....g.................4.....A.......................#.................$ ....7 ..... .....!....W!....k!.....!.....!....."....."....g"....."....."....."....-#....x#.....#.....#.....$....Y$.....$.....$.....$....>%....m%....w%.....%.....&....B&....L&.....&.....&.....'....('.....'.....'.....(.....(....q(.....(.....(.....)....Y).....).....).....).....*....T*....s*.....*.....*....2+....]+....p+.....+.....,....G,....i,.....,.....,.....-.....-....w-.....-.....-..........v................../...../.....0....f0....u0.....0....?1....y1.....1.....1....F2....t2.....2.....2.....3....,3....<3.....3.....3....24

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\it.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):581016
                                                                                                                                                                              Entropy (8bit):5.296715563664076
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:Mkqu5NjNJ2IU9UTx994eN7NgvESIqRRxsO1ytnvWjRT9Tj+rhazYDxrvAqpzSw9S:MkSLlZm128uJekfzEpe5kLISa
                                                                                                                                                                              MD5:6AA3BC3EE4999C324B82E50940E62C74
                                                                                                                                                                              SHA1:10AF8030FC2F875E133C9417E0221528160AD8B5
                                                                                                                                                                              SHA-256:73CC8422643A65753B2C3672C8F8331EE92C9BDDC912576554E95B0986CF990D
                                                                                                                                                                              SHA-512:F039EF32002E55D09A4F567CC81FE2B3B329D517C985436A5DA121FF0E6AC7E258B5D1FDDA81E6C1578DAF7078B91ABCFB7DA98CDBA6693D4FBE7F28115E6971
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.....j.....k.....l.!...n.)...o.....p.;...q.A...r.M...s.|...t.....v.....w.....y.....z.I...|.p...}...............................................................................".....;.....L...........u.................d...................................r...................................G............................._.......................v................._.................S..........." ....h ....y ..... ....9!....s!.....!.....!....`"....."....."....G#.....#.....$....,$.....$.....$.....%....$%....t%.....%.....%.....%....@&.....&.....&.....&....#'.....'.....'.....'....+(....~(.....(.....(.....)....Y).....).....).....)....-*....[*....d*.....*.....+....:+....E+.....+....,,....z,.....,.....,....6-...._-....x-.....-.....-.................................../...../...../..../0....l0.....0.....1....31....H1.....1.....1.....2....!2.....2.....3....Y3.....3.....4.....4.....4.....5.....5.....6....[6.....6.....7....r7.....7.....7....!8....a8.....8.....8.....9....c9.....9

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\ja.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):708098
                                                                                                                                                                              Entropy (8bit):5.712005061370792
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:SCG5Mw77QWN7v5DD79ZgQ21XymbA5zFLdbvVt:SrSw7NN7F9ZgQ21Xi5zFLdj
                                                                                                                                                                              MD5:5A69547F56DC61E482DCDA1CE704C5AC
                                                                                                                                                                              SHA1:5B7BBC8E9B14D78F2105136AFB7728050128C02E
                                                                                                                                                                              SHA-256:A286A5FAF9021927EC09FD8CBF30ED14AD59C3BAA36D29E5491AD27B957915E5
                                                                                                                                                                              SHA-512:2B9D020544201E2D0B0B44B0977FCBAB858563969CE02BE65689C5F5B780ADC4560DF523589293CD66F42903322ED61D781DA093ADFA44AA0681A28D97DE4556
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........'..e.f...h.n...i.y...j.....k.....l.....m.....o.....p.....q.....v.$...w.P...y.w...z.....|.....}.......&.....+.....3.....>.....F.....U.....Z.....b.....i.....p.....w.....y.....~.........................................l...................................p...........S.....n.....4...........P.....{...........k.......................|.................H............................. .....g.................h ..... ..... .....!.....!.....!.....!....6".....".....".....".....#....4$.....$.....$.....%....w%.....%.....%....;&.....&.....&.....'.....'....%(....l(.....(....4).....).... *....D*.....*....I+.....+.....+....#,.....,.....,.....,....j-.....-..........+...........6/...../...../....80.....0....(1....G1.....1....A2....{2.....2.....3.....3.....3.....3....Z4.....4.....5....35.....5....?6.....6.....6....*7.....7.....7.....7....B8.....8.....8.....9.....9.....9.....:....5:.....:....|;.....;.....;.....<.....=...._=.....=.....>.....>.....>.....>....z?.....?...."@....>@.....@....LA.....A.....A

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\kn.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1424056
                                                                                                                                                                              Entropy (8bit):4.241400387342817
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:X3WMqESgQzb4OpsJHVLl6S3AE745LmWA4hqSm2G:Nqed65qWo
                                                                                                                                                                              MD5:52A0707A70B939BCD75B0838A5DC5357
                                                                                                                                                                              SHA1:EB9E1350D9D217580B1939302D008DC07C3B781C
                                                                                                                                                                              SHA-256:B177EDA102B1BE8C53127E3BB47970A3C1E2032BE24900D8A126C5F0F077EF3D
                                                                                                                                                                              SHA-512:D5FE69035338C4308F661FA0AC25C4A811A6014F6BD85CCC7AD947F76AECF76F67208512E1266E249EC067A5FB22FB74A3550B0F3AEB1BC50FADB3A9D3CC67E4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.B...h.J...i.[...j.g...k.v...l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.T...y.{...z.....|.....}.......*...../.....7.....?.....G.....N.....U.....\.....].....^.....c.......................].............................D.....L...........[.................. ..... .....!....."....`#.....#....\$.....$....S%.....%....t&....='.....'.....'.....).....)....t*.....*....5,....D-..........|....../....V0.....0....%1....42.....3.....3.....3....,5....B6.....7....T7.....8.....9.....:....C;.....;....u<.....<.....<.....=....C>.....>.....>....X?.....?....A@....V@....9A.....A....zB.....B.....C....BD.....D.....D.....E....EF.....F.....F.....G....sH.....H.....I.....I.....J.....K....CK....eL....dM....$N....SN....6O.....O....TP.....P....AQ.....Q.....R..../R.....S.....S....1T....cT.....U....SV.....V....hW....PX.....X....UY.....Y.....Z.....[....*\....|\.....].....^....W_....._....+a.....b.....c.....c....;e....9f.....f....og.....h.....i....2j.....j....Lk.....k...._l.....l.....m.....n....`o

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\ko.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):599188
                                                                                                                                                                              Entropy (8bit):6.077314293748852
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:Twg3X8cvlA/t0ZTvIXzxMSAG0GlzRXhw3zTt8Onat7DXCqYwHs5Ra1i7vlq5zULq:TH75vKpCWj
                                                                                                                                                                              MD5:4B563EB612D4FADC6BD8A4C918006AB1
                                                                                                                                                                              SHA1:4B9E414AF0C044C4487D1439D23EF11B0169D308
                                                                                                                                                                              SHA-256:E0D4461452607E0F4A619EFE653EC9EC39F7D34A742AE98374B2BCE0B821ADC9
                                                                                                                                                                              SHA-512:B8C56D69FA41AD14F7197ACAB1BA987EBB06C5B15748E21CEC27861721545E30FB20F76F2C3A752C8EA94CCA1E6B4FAB7FB0727B679A8FB8E94DB2D5C028E7A6
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........'..e.....h.....i.%...j.0...k.\...l.d...m.l...o.....p.....q.....r.....s.....t.....y.'...z.U...|.|...}.........................................................................+.....;.....N.....^...........Q.................(.......................[.................#.................5.....I.................<.....L.................?.....R.................B.....]...........;.....p.................?.....m.....z...........1.....].....j...........<.....t............ ..... ..... ..... ....P!.....!.....!.....!....0"....~".....".....".....#....Y#....~#.....#.....$....r$.....$.....$....3%.....%.....%.....%....>&.....&.....&.....&....E'.....'.....'.....'....B(.....(.....(.....(....`).....).....*..../*.....*.....*.....*.....+.....+.....+.....,.....,.....,.....,.....-.....-.....-..........L.....|............/...../....+/...../...../.....0....(0.....0.....0.....1....-1.....1....+2....q2.....2.....2....X3.....3.....3.....4....h4.....4.....4.....5....]5....}5.....5.....5....R6.....6.....6.....7

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\lt.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):644262
                                                                                                                                                                              Entropy (8bit):5.6356477666035865
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:kjFt+0US0MAcrMqecJwuxZ5b7MjC3jqt6S0M:WFQ0GMnrLZ5sjIjqN
                                                                                                                                                                              MD5:7CEF6E31D76861DB4D7D622FDD89E5AA
                                                                                                                                                                              SHA1:31FA45C3B7666259D4D8A13518ECE423A97EDCCA
                                                                                                                                                                              SHA-256:2F1E1C69DA5CAD8F47E45AF0AC47CEC90C20FE2897A43CB496C7FEED1EC5D1AB
                                                                                                                                                                              SHA-512:DF66A739F3A8DA62A942B56B23F71A2B68469E87DC44EB8CE1A9A859A609F1DB4BEE2497DEFEF06FA48E14CF461E61410668A5216459C94C79F4B69A3CF092F6
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.#...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.C...z.q...|.....}.................................................$.....%.....&.....(.....6.....C.....W.....h....................... ...........6.....}...........0.................$.................S.....m...........f.................$.......................w...........%.....J...........] ..... ..... ....5!.....!.....!.....!....j".....".....#.....#.....#....F$.....$.....$....7%.....%.....&....3&.....&.....'....<'....W'.....'....:(....j(....|(.....(....h).....).....)....(*.....*.....*.....*....m+.....+....',....6,.....,....4-....o-.....-............................6/...../...../...../.....0....%1....x1.....1.....2....|2.....2.....2....W3.....3.....4....<4.....4.....5....d5....|5.....6.....6.....6.....6....l7.....7.....7.....8.....8....19....s9.....9....$:.....:.....:.....;.....;....T<.....<.....<....G=.....=.....>....)>.....>....[?.....?.....?.....@....r@.....@.....@....+A.....A.....A

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\lv.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):643309
                                                                                                                                                                              Entropy (8bit):5.637177021245093
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:Uz9waCt7x2/28mvsf4xN3tVF89voxEJiiUh/7bOEw5hp1UrFeTE/CoCKbnh2Degl:UFuKvNMEGFOEw5WFeTunbf35S
                                                                                                                                                                              MD5:00B517CE675A3089823708776C6F9302
                                                                                                                                                                              SHA1:2BC24F150ADAAFD2604C5D95BBAAF8DC983D7DA2
                                                                                                                                                                              SHA-256:0ADEDD1EAAF902FEEBB208220D9F21AE1B0175E74F6A966CD7ED226146D86AE8
                                                                                                                                                                              SHA-512:6C19A0D779185141FB050369F9FBFE60D0B838E55E2674E3F14A67E1A6970727E329656E458CA8516A41C97B20E67EB1789587AF957129B3D32C94A3536AB12E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.2...w.^...y.....z.....|.....}.......4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....j.....}.......................\...........k...................................\...........R.....o.............................:.......................j...........2.....D...........4.....f...........% ..... .....!....A!.....!....B".....".....".....#.....#.....#.....#...._$.....$....E%....b%.....%.....&.....&.....'....X'.....'.....'.....(....b(.....(.....(.....)....n).....).....*.....*.....*....0+....u+.....+.....+....p,.....,.....,.....-.....-.....-.....-....N............/...../...../.....0....G0....X0.....0.....1.....1.....1....K2.....2.....2.....2....`3.....3.....4....=4.....4.....5....15....@5.....5...._6.....6.....6....:7.....7.....7.....7....b8.....8.....9....39.....9....1:....u:.....:....+;.....;....P<....c<.....<....f=.....=.....=....5>.....>.....>.....?....o?.....?.....?.....@.....@....-A....qA

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\ml.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1481376
                                                                                                                                                                              Entropy (8bit):4.274098791777635
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:gtUOGVx75aWEyghv479y6DPnXKfhBP1zXnxooG98MF3e7hDK5V6jX9fb3VV:gtuxmGKfhBP1zX23F3ek5V6jX9D3j
                                                                                                                                                                              MD5:D32A29A61E8AFABA6B42D236257D9929
                                                                                                                                                                              SHA1:9664F50EA7590A47C2EB8EB4A3E49BE556D08F7A
                                                                                                                                                                              SHA-256:A59FD15C969EE8FFD7E72F5A2245C6A5A4FC048F7899FCA489D78C8F6394CA1E
                                                                                                                                                                              SHA-512:2668976853B26B22859F8C20AFAEB4D641845E94779B8994B49F240302420279E3F9A99666B8F551495B7D5A8C3C83609B7ECF276FABD8345CC8C787319EA3D2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.@...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.&...w.R...y.y...z.....|.....}.......(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....a.......................j...........<.....+.....x.................B.................] ....L!.....!.....".....#....h$.....$.....%....Y&.....&.....'.....'.....(....t).....).....*....n+.....+....4,.....-..........X/...../.....0.....1....W2.....2.....3.....4.... 5....d5.....6.....7....o8.....8....I:.....;.....<.....<.....=....U>.....>.....>.....?....g@.....@.....@.....A.....B.....B.....C.....C.....D....AE....uE....YF.....F....pG.....G.....H....YI.....I.....J.....J.....K....BL.....L....NM.....N.....N.....N.....O.....P.....Q.....Q.....R.....S.....T....DT.....U.....U.....U....?V.....W.....W.....X.....X.....Y.....Z.....[.....[.....\.....].....^....E^....g_....^`.....`....?a....~b....@c.....c....>d....le.....f....dg.....g.....h.....i.....j.....j.....l.....m.....m.....n.....n.....o....Pp.....p.....q.....r.....s

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\mr.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1222173
                                                                                                                                                                              Entropy (8bit):4.300698800250203
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3072:gOG1c9CX6VI4KBYmiMpvVL8lownlWGrInbizwF/yGRu3RxYR3GodgEWYJrOznupW:fG0m4lwcasmKZKbzNvfq1E5imHReZ
                                                                                                                                                                              MD5:0E5B29B6AE74A1F94CA4F880F131A79F
                                                                                                                                                                              SHA1:6AC5089ACE05847480D2AEEC89954124CAA781AA
                                                                                                                                                                              SHA-256:25BF8E86F7C9E88F68D4C40C4F124C16F60DAF22E7A87F55BA2C560A0F640BC9
                                                                                                                                                                              SHA-512:30717C0AEF4458BBCF7472316727981829EDADA8BE3003AFD9D65CB01D4CF309F601B1C41539343D6239CB2E9157554C95CF966A4156458A2FD78D2464075C98
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:........q(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.C...t.Z...v.....w.....y.....z.....|.7...}.h...................................................................................-.....z.....................................................R...........U............ .....!....6"....b"....5#.....#....P$.....$....^%....-&.....&.....&.....'.....(.....)....T).....*.....,.....,....5-....S.....V/...../....$0....K1....K2.....2.....3....C4....a5.....6....J6.....7.....8.....9.....:.....;.....;....9<....s<....6=.....=....+>....W>.....?.....?.....?.....@.....A.....A....\B.....B....|C....RD.....D.....D.....E....uF.....F.....F.....G....uH.....H.....H.....I.....J.....J.....K....RL....{M....=N....|N....;O.....O....4P....]P.....P.....Q.....Q.....Q.....R.....S.....T....+T....TU....OV.....V....eW....OX.....Y....mY.....Y.....Z.....[....k\.....\.....].....^....n_....._.....`....Qb....:c....ac.....d.....e...._f.....f.....g.....h.....i....]i.....j.....j....Wk.....k.....l.....m....!n

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\ms.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):554824
                                                                                                                                                                              Entropy (8bit):5.250627975386066
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:1fZuPdEaPHdoDKUaxe+2cgFRlWWNxTUcWR95bxlqyGkuBm9ch:xg9HEsxd2hlWEG95vFG3
                                                                                                                                                                              MD5:6149507C3AA99C4012D9D7CFE4BC30C8
                                                                                                                                                                              SHA1:51A2BB5CBAE64F3877AFC342EA0F43915702F8F4
                                                                                                                                                                              SHA-256:DD75481D67D9BE36ECB2E421117395FBB75B7623164F13A09BE1CF3CE76D588F
                                                                                                                                                                              SHA-512:71F8DC03618D46BE7B036353526BF20A61E648EF50ADEEEC057D314E9A4536899C37EF691164BF9DE9E10A3867749F8D3D6F4038E16C82CF6122E7AB4A1C7732
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.^...h.f...i.n...j.z...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.;...w.g...y.....z.....|.....}.......=.....B.....J.....R.....Z.....a.....h.....o.....p.....q.....v.............................d...........4.....O.................B.....R...........0.....q.................^.......................f.......................[.......................`................./.......................P.......................- ..... ..... ..... .....!....y!.....!.....!....8".....".....#.....#...._#.....#.....#.....#....!$....t$.....$.....$.....$....G%....n%....z%.....%....A&....{&.....&.....&....I'....~'.....'.....'....?(....q(....{(.....(....-)....])....f).....).... *....S*....^*.....*....A+.....+.....+.....+....B,....g,.....,.....,...."-....F-....`-.....-.....-....(.....9................../....@/...../...../...../...../....U0.....0.....0.....0....e1.....1.....1.....2.....2.....3...._3....m3.....3....<4....w4.....4.....4....I5....w5.....5.....5.....6....;6....K6.....6.....6....&7

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\nb.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):537830
                                                                                                                                                                              Entropy (8bit):5.4264919827777245
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:GFxHxFb73kroOp7fBpHXYbhOs5wk+bhPLgg5t:GXxFXkJ1YbhOs5f+bFUG
                                                                                                                                                                              MD5:2A0EC73D03D4D7FCEC71AD66CC0D4B30
                                                                                                                                                                              SHA1:BB8DF6E11B02086726ECEDE97D5F729F4197323C
                                                                                                                                                                              SHA-256:D44EF5E644B1B8F7C056D5E20651515FCC8565BEFEC575091735FB39C6D63554
                                                                                                                                                                              SHA-512:CDCB4E436270156E263D731CE243D821C5361B18B6D7B8259875C9D895301D478A87FEB7CAFC3376D09D18D27F32DC403FD2CBD034D68736CB968BBEFEBD642B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h. ...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.0...y.W...z.....|.....}...............................#.....*.....1.....8.....9.....:.....<.....G.....V.....i..................................._...................................n.................P.......................M.....w.................:.....c.....r...........B.....r.................w.................`...........- ....L ..... ....&!....^!....r!.....!....r"....."....."....m#.....#....J$....l$.....$.....%.....%....'%....}%.....%.....%.....&....`&.....&.....&.....&....I'.....'.....'.....(...._(.....(.....(.....(....a).....).....).....*...._*.....*.....*.....*....Q+.....+.....+.....+....`,.....,.....-....5-.....-.....-................x................../....[/...../...../...../....b0.....0.....1....F1.....1.....1.... 2....92.....2.....3....23....J3.....3.....4....J4....^4.....4....95....u5.....5.....6.....6.....6.....7....o7.....7.....7.....8....Y8.....8.....8.....8....<9.....9.....9

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\nl.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):556268
                                                                                                                                                                              Entropy (8bit):5.362124110769206
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:jVAWY0lbJ9WQusFUiFgN5tmDdx5btfKzaWDZqqn9pmTy:qWY0lbJ9WQusFU15tmDdx5bFKzaWVqq1
                                                                                                                                                                              MD5:E8B790166D701F63A60C3B322FCCE234
                                                                                                                                                                              SHA1:61EC318AA8030F7D29C3258126B156D1D3EEFA2C
                                                                                                                                                                              SHA-256:3D73B0110E5832B6A7C7B7E64018368464EF8552D6A98592D0ADBF713EB9755E
                                                                                                                                                                              SHA-512:4E4B299CB55CBB5906FF974BB5E5078D2018298B5EE6D9CA0E40AAB8DB542AAEDC4BD7A5DB242A2C5194BC90C07631F627043DCC1A9F2D095A28C3E35F212DD9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.....j.....k."...l.-...n.5...o.:...p.G...q.M...r.Y...s.....t.....v.....w.....y.'...z.U...|.|...}...............................................................................(.....9.....K...........m.................W.......................{...........3.....I.................L.....c.................7.....F.......................(.................7.....X...........0.....g.................E.....z.................T ..... ..... .....!.....!.....!.....!....[".....".....#....3#.....#.....#.....#.....$....X$.....$.....$.....$....,%....}%.....%.....%.....&....|&.....&.....&.....'....u'.....'.....'.....(....U(.....(.....(.....(....4)....`)....m).....)....)*....]*....l*.....*....H+.....+.....+.....,....W,.....,.....,.....,....=-....^-....u-.....-....+.....S.....e...........7/....n/...../...../....<0....Z0....n0.....0....21....d1....u1.....1....G2.....2.....2....-3.....3.....4.....4.....4.....5....D5....i5.....5....46....e6....z6.....6.....7....A7....Q7.....7.....8....A8

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\pl.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):619265
                                                                                                                                                                              Entropy (8bit):5.770526396702215
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:zifPIC1WoOB/ktv/XfQfuzSJY9HQbyDPSCUd4e3m7UyMgmx1QhH1b5FuH4VZy:YTxbMJ1Qh15w
                                                                                                                                                                              MD5:8A4354163FF3B0978A568F781BDAC289
                                                                                                                                                                              SHA1:45DE421F35AF79ADF962809CF8D0E6D2ADBCB553
                                                                                                                                                                              SHA-256:2F6DE0F9A46AE0B75BEB67E09FFEEE12483842A7CD6F2A2382CCBE36FBFC17E3
                                                                                                                                                                              SHA-512:5760F20228AFE74E9FF2A916A168E8CC2D4A64D8E76065E61A7A60616A473C7DC3DA4805125B270F179B7A0F291071E81D761D82EEC3B130D552B57ABD76C127
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i./...j.9...k.H...l.S...n.[...o.`...p.m...q.s...r.....s.....t.....v.....w.&...y.M...z.{...|.....}..................................... .....'.........../.....0.....2.....A.....O.....d.....y.........................................%.....8...........M.......................u................./.......................(.......................I...................................I.....n...........8 ....p ..... ..... ....M!.....!.....!.....".....".....".....".....#.....$....d$.....$.....$....$%....9%....Z%.....%.....%.....&....&&....o&.....&.....&.....&....O'.....'.....'.....'....](.....(.....(.....(....Y).....).....).....)....J*.....*.....*.....*....:+.....+.....+.....+....Q,.....,.....-....+-....y-.....-.....-.....-....Y.......................E/...../...../...../....g0.....0.....1....@1.....1.....1.....1.....2....s2.....2.....2.....3.....3.....3....+4....E4.....4....85.....5.....5....%6.....6.....6.....7....c7.....7.....7.....7....@8.....8.....8.....8....$9.....9.....9

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\pt-BR.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):581655
                                                                                                                                                                              Entropy (8bit):5.426534241883623
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:mHM4QhMCJi4wNNBXBLGfs9y+z5GHNXun0msRgMpI2:CchHi4wD50XosR9pN
                                                                                                                                                                              MD5:B1AB7D7AA67A7B61BFA9AEBAD0B812AF
                                                                                                                                                                              SHA1:95EFF4BE517C0A25C34578DEF10D48C77021DE1A
                                                                                                                                                                              SHA-256:5BD503C413AAF8FA87FD47C341D437ACCC25397A50B082068BCF2F3BB4FB27C7
                                                                                                                                                                              SHA-512:8498FE7727771DF3C1EB34560C1E25B0C30690C7C921104B4ADCF04CC5753462BAC513A60A5833CB6F57733201D4883605F8A4EC4A457F3EBC7C952090B1A9E1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.-...j.9...k.H...l.S...n.[...o.`...p.m...q.s...r.....s.....t.....v.....w.&...y.M...z.{...|.....}..................................... .....'.........../.....0.....5.....G.....W.....y.............................%.................%.....5...........R.................4.......................6.............................r.................G.................'.................d................._ ..... ..... .....!....}!.....!.....!....J".....".....#....!#.....#....-$.....$.....$.....$....>%....d%....w%.....%.....&....d&....s&.....&....+'....`'....n'.....'....4(....o(.....(.....(....-)....^)....j).....).....*....:*....D*.....*.....*.....+.....+....}+.....+.....,....$,.....,.....-....q-.....-.....-....'.....K.....`................../....y/...../...../.....0.....0.....1....F1.....1.....1.....2....-2.....2.....2.....2.....3.....3.....3....(4....D4.....4....D5.....5.....5....A6.....6.....6....'7.....7.....7.....8.....8....e8.....8.....8.....8....`9.....9.....:....!:.....:

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\pt-PT.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):585544
                                                                                                                                                                              Entropy (8bit):5.398721361990628
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:EdZCITRW+kQdJs7ieJVJJxhbHMm5wfBCV5z6jPdoSR7oF:6XJksvMV5+jPSSR7Y
                                                                                                                                                                              MD5:CBE5E35F844F5F1400DF3685CC847694
                                                                                                                                                                              SHA1:E60CDB0A813A97C8548C878276BFAE155350BB42
                                                                                                                                                                              SHA-256:6B9BD714D217D596183894FFED3174A617E1C8CFAE292231D4B967183B589C6B
                                                                                                                                                                              SHA-512:96046C97436A3DBF5AAC479B9EAA9DFDCFC81F1EDCAEE9CD65D59BEB0CE6B6B42828E0D170AAEF2EF1D68988F7916AC1DBAC0D84218DE83FEDCCA8592DE4C1F1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.X...h.`...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.>...w.j...y.....z.....|.....}.......@.....E.....M.....U.....].....d.....k.....r.....s.....t.....y.............................U...........=.....Z...........%.....p...............................................8.....\.................).....9.........................................O.....}...........].................- ..... ..... ..... ....L!.....!.....!....."....i".....".....#....3#.....#....)$.....$.....$.....$....U%.....%.....%.....%....C&....t&.....&.....&....F'.....'.....'.....'....V(.....(.....(.....(....W).....).....).....)....:*....g*....q*.....*.....+....@+....J+.....+.....,....5,....F,.....,....$-....t-.....-.....-....4.....^.....z................../....$/...../...../.....0..../0.....0.....1....U1.....1.....1.....2....H2....Z2.....2.....3....>3....S3.....3.....4....b4....|4.....5.....5.....5.....5....u6.....6....,7....P7.....7....38....s8.....8.....8....'9....L9....a9.....9..../:....k:

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\ro.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):606335
                                                                                                                                                                              Entropy (8bit):5.4540537912984615
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:kxrPkiHXWrfGENd49ow6q0gdKXKkQGXq5e3jUZGs2hj/Xrbf:CrxXWr3Nu9o7qHKasq5ezUuj/3f
                                                                                                                                                                              MD5:5DB10EDF772656C0808DD8DA698334BF
                                                                                                                                                                              SHA1:3CAF7C9D5A3B44E06E0588DABA698B6970EA06F5
                                                                                                                                                                              SHA-256:73B6A63352906D77196F38A1DF937EC0770160FB7A93321867C7994ED3E7967B
                                                                                                                                                                              SHA-512:EB253B548C7F574943136764A23818F9DEDEA17FF42F92DC8591F4B7C297ACCDDE9F6B2C0AD96F1FD0815C53940C0102A90C603F9F4D6D9C8FB053B559CC7A62
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.!...j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.?...z.m...|.....}................................................. .....!.....".....$.....3.....?.....M....._...........w.................P...................................T.....s...........\.......................g.......................C.....l.................a.................N................."............ ....H ....a ..... ....$!....X!....m!.....!....C"....."....."....0#.....#.....$.....$.....$.....$.....$.....%....W%.....%.....%.....%....(&....u&.....&.....&.....'....e'.....'.....'.....(...._(.....(.....(.....(....G)....q).....).....).....*....C*....S*.....*.....+....4+....H+.....+....@,.....,.....,.....,....G-....f-....|-.....-..........7.....[............/....K/....^/...../....O0.....0.....0....&1....i1.....1.....1.....2....x2.....2.....2....B3.....3.....3.....3....g4.....4....95....R5.....5....C6.....6.....6....&7.....7.....7.....7....*8....t8.....8.....8....,9.....9.....9

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\ru.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):996315
                                                                                                                                                                              Entropy (8bit):4.845331047532895
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:4I6pfQjRo4YSWPAY+zJ9LF1WAati/16HzW/yqSvDsNL4kXew+YHVeXN2hVO3j/iH:4T25H3Oc
                                                                                                                                                                              MD5:E9AF20A6226511CD535888846A2BB16F
                                                                                                                                                                              SHA1:739A46269F334ECC291BAE6777F0B7C8E271E4C0
                                                                                                                                                                              SHA-256:5DB640C6C288D9FC79012A7670301A3BC463359C17BA200AEDAA56260EF8D955
                                                                                                                                                                              SHA-512:7897C500718382F08D55F3CDDD96D1451524B5C2B8FEBC65E1700A645598B622C819EC66E4A21C119F044FAAA525A2ABDDDF66D0C9800AF6ECEA9CEB217A88BB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(d.e.....h.....i.....j.....k.....l.....n.....o.....p.%...q.+...r.7...s.f...t.}...v.....w.....y.....z.3...|.Z...}...............................................................................$.....<.....c.....X.....$...............................................D.............................G...........0...........8.....[.................Q.....h...... ..... .....!....J!....=".....#.....#.....#....z$.....%...._%.....%....;&.....&.....'....A'.....'.....(....#)....P)....T*....N+.....+.....,.....,....0-....]-.....-............................_/...../...../.....0.....0.....1....X1....}1....#2.....2.....2...."3.....3....%4....`4....w4.....4....t5.....5.....5....B6.....6.....6.....7.....8.....8...._9.....9.....:.....:.....:.....:....T;.....;.....;.....;....|<.....=.....=.....=.....>.....?.....?.....?....|@.....@.....A.....A.....A....GB.....B.....B.....C.....C....mD.....D....jE...."F.....F.....F.....G.....H.....I....lI.....J.....J.....J.....J....xK.....K....&L....?L.....M.....M....4N

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\sk.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):626605
                                                                                                                                                                              Entropy (8bit):5.815043408006658
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:6fKTvoktDh40i/igVQm5611wYZLtWTjsxt9Wl:6KTdjib5ewsPtIl
                                                                                                                                                                              MD5:B0BBB6661370D27B6600EBE98CADB9AC
                                                                                                                                                                              SHA1:1139852DA47048F15C16EB101DAC86DFC8F652BA
                                                                                                                                                                              SHA-256:E0FE4130E668AC659D5334C5BC8CDE70BBA8742273B5965836860B5A8B1B016A
                                                                                                                                                                              SHA-512:C8EAC323552F873EC088F77B8C46522387B0298B6D566CF8AA173FA9B2D66389068BB26E46044AF2FAA4224B39DC748164843B58B99E9DDE093FCB32AFB5FED0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.....j.:...k.I...l.T...n.\...o.a...p.n...q.t...r.....s.....t.....v.....w.'...y.N...z.|...|.....}.....................................!.....(...../.....0.....1.....3.....G.....O.....a.....v.....2...........N.....l...........M.................'.........................................6.................4.....G.................).....=.................K.....p.............................z ..... ....,!....E!.....!....("....^"....o"....."....v#.....#.....#....d$.....$....B%....]%.....%.....&....3&....H&.....&.....'..../'....A'.....'.....(....)(....;(.....(.....)....Y)....o).....)....L*.....*.....*.....*....X+.....+.....+.....+....u,.....,.....,.....-.....-.....-.....-....s...........D/....\/...../...../.....0....+0.....0.....0.....0.....1.....1.....1.....2....#2.....2.... 3....e3.....3.....3....C4...._4....t4.....4....R5....y5.....5.....6.....6.....6.....6.....7.....8.....8.....8.....9.....9.....9.....9....O:.....:.....:.....:....L;.....;.....;.....;...._<.....<.....=

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\sl.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):601837
                                                                                                                                                                              Entropy (8bit):5.489524001909229
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:mZ9VfcB2z/i1SE5vqfCWJU171i/fzSjqc:mHVBWSE5vqfmi/fzSl
                                                                                                                                                                              MD5:AA7C0F35B61A230D65E498DAAB67388C
                                                                                                                                                                              SHA1:F60CB1C7128A1FB1CFD9AA029F96DF36033777D0
                                                                                                                                                                              SHA-256:03AFC83CDBA98C08AF169C8AE111AA916F3EE6D5A2FEE4954EF35ECC063F2B21
                                                                                                                                                                              SHA-512:048D03C490F18D22F4900363F9C4ABEE037A2029F226C90806064FFEDC85B07A1D86225B9C534311B08F588632A84221D7E4FA355E7B768CFDFD6102C5FFE705
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.....j.....k."...l.-...n.5...o.:...p.G...q.M...r.Y...s.....t.....v.....w.....y.'...z.U...|.|...}...............................................................................,.....<.....O...........n.................J...................................N.....m...........9.....m.................8.....c.....p...........+.....V.....e...........G.....|........... .......................]............ ..... ..... ..... ....%!....9!.....!....3"....j"....."....$#.....#.....#.....$....v$.....$.....$.....$....T%.....%.....%.....%....?&.....&.....&.....&....K'.....'.....'.....(....n(.....(.....).....).....).....)....;*....P*.....*.....+....:+....M+.....+.....,....B,....Q,.....,....,-....i-.....-.....-....8.....X.....p............/....;/....V/...../.....0....\0....n0.....0....O1.....1.....1.....2....l2.....2.....2.....3....x3.....3.....3....34.....4.....4.....4.....5..../6.....6.....6....j7.....7....@8....}8.....8....T9.....9.....9.....9....;:....Y:....i:.....:....I;.....;

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\sr.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):924863
                                                                                                                                                                              Entropy (8bit):4.7696519516761695
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:nP3ydDCzsexx7UinNLQIlApSld7vwFi4CBaAwH5YvTEquCxa4F37nyIzy/k/S:P3G2zBTfWt5suBr
                                                                                                                                                                              MD5:ABDD9EB966D915C1896B31CBA0B2656B
                                                                                                                                                                              SHA1:CB0080E5F2C168CD0F3EDC6ED6C47734FFD67790
                                                                                                                                                                              SHA-256:3913D3BE5016CE873AC68AF376D5FCF558BB5F5F29A9BC56DF0099BA47E52486
                                                                                                                                                                              SHA-512:BCB258D6DA766BB6F00DFDBB03BC878000D9CF28B2B707375CE52485DB9C530A34D1528A1473F09B5765BC57ABD847F191BDE55646EB707443CD0E40509B70E1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e. ...h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...q.....r.....s.....t.....v.....w.2...y.Y...z.....|.....}...............................%.....,.....3.....:.....;.....<.....>.....h................................... .....R.................#.....F.....A.............................M.......................) ....| ..... ....(!.....!.....!.....!....."....b#.....#.....#.....$.....%....=&.....&....C'.....'....B(....k(....').....).... *....E*....++.....+....b,.....,.....-....y....../....V/...../....V0.....0.....0....B1.....1.....1.....2.....2.....3....G3....f3....*4.....4....+5....V5.....5.....6.....6.....6.....7.....8....Q8....l8.....9.....9.....9.....9.....:.....;....n;.....;....[<.....=.....=.....=....E>.....>.....>.....?.....?....%@....^@.....@....EA.....A....$B....AB.....C.....C.....D....\D.....D....eE.....E.....E.....F.....G....lG.....G....xH.....H....yI.....I.....J....fK.....K.....L.....M.....M....!N....kN....%O.....O.....P....%P.....P.... Q....XQ....uQ....FR.....R....[S

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\sv.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):541025
                                                                                                                                                                              Entropy (8bit):5.5401177610527155
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:MnZyPzw0uHrwiTR91Q0Z4IoogVChcxorsl6hI+vRFcz5RtGl2KYF4bkvMrOSOgfm:i8U7DTC0Z4KhJW5krMTMo
                                                                                                                                                                              MD5:CC0806219798E3ADE0437219457A37AB
                                                                                                                                                                              SHA1:DD6BA47E14B7B0D08159FBCA2409B013DC2E17DE
                                                                                                                                                                              SHA-256:79A7260C8651FF3024E21F9263543BF4E9D5F3574E81CF96EDF6388F8DA85CD1
                                                                                                                                                                              SHA-512:DF3DA02BB2FECBBAF1AB80AF8EF8B1A7AE9F6C7ED01F94C5A502720376924132C344DD716FC5B4DDC03733A6C3581ED8D8A577154C619BA85C527DC67F4A48C2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:........p(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.8...t.O...v.....w.....y.....z.....|.,...}.]...........................................................................................................Y.....o...........B.........................................e.......................r.......................r...................................1.....Q...........?.......................].................. ....x ..... ..... ....E!.....!....."....#"....."....N#.....#.....#.....$....n$.....$.....$.....$....O%....t%.....%.....%....-&....S&....b&.....&....2'....i'....{'.....'....6(....d(....s(.....(....()....S)....b).....).....*....C*....S*.....*.....+....H+....W+.....+....*,....e,....z,.....,....%-....E-....^-.....-.....-..........1.....}.......................u/...../.....0....D0.....0.....0.....1....-1.....1.....1.....2....&2.....2.....2.....3....03.....3....44.....4.....4.....5.....5.....5.....5....W6.....6.....6.....6....F7.....7.....7.....7.....8.....8.....8

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\sw.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):570564
                                                                                                                                                                              Entropy (8bit):5.341574755821131
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:Evzozr9Cpdjcu25KmedqrCBfRdpG5PbQW49qx2FRyl+Y4jNUkCarOg6jP5AuNskZ:Evk3v15zsI
                                                                                                                                                                              MD5:A63EF2C4676DFBEE98E29A84A7AD9D27
                                                                                                                                                                              SHA1:2F0F4B33ACF5E63F3159C62C74DEAA9A361203F4
                                                                                                                                                                              SHA-256:7B8C51B247DEA72D68CB0EF4292800C13209DA6F859A9AD289C996582F19E65C
                                                                                                                                                                              SHA-512:CD65FD2C49D35757DE648F21DEC748FB4A1D13D2308552774FE9C859AD5748B21F5DB449F8B380520F27DC868A3EBAAFD58D4C45ABA34033785777D342E17E6F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.!...j.-...k.<...l.G...n.O...o.T...p.a...q.g...r.s...s.....t.....v.....w.....y.A...z.o...|.....}.................................................".....#.....$.....).....;.....K....._.....v.............................U...................................L.....b.................I.....].................2.....A.......................).................*.....P...........N.................%.......................3 ..... ..... ..... ....4!.....!.....!.....!....q"....."....J#....f#.....#.....$....8$....S$.....$.....$.....%.....%....Z%.....%.....%.....%....L&.....&.....'.....'....m'.....'.....'.....(....n(.....(.....).....)....l).....).....).....)....X*.....*.....*.....*....q+.....+....",....;,.....,.....,.....-....6-.....-.....-....).....J............/....F/....V/...../....20....{0.....0.....1....N1....o1.....1.....1....02....X2....j2.....2....F3.....3.....3....04.....4.....5.....5.....5.....5....>6....[6.....6....P7.....7.....7.....8....j8.....8.....8....89.....9.....9

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\ta.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1468553
                                                                                                                                                                              Entropy (8bit):4.052663401346278
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3072:eO7hLhGq5MLs32+5CrVKa1i55G62sRtRdutm1vYpiMy+:rdLhGoC+sBD1i554sRtRdutm1vYpiMy+
                                                                                                                                                                              MD5:AA06EAD1200F01C9460399F0ABE2D54F
                                                                                                                                                                              SHA1:9B852C4691209C0AE9EDF94A5DEC4B902FEC7B3E
                                                                                                                                                                              SHA-256:1946D903918C57836D2F898EF93CD1D575DA1A464E358C399DFDE73EA2EF057E
                                                                                                                                                                              SHA-512:6E556B962C16AEE22695D93B62B308D95B0695873FB33D13A147B3D8B6791C9599DAA6E3BF424A1897212A018AB36DD8C8214C2EB03457048C6931686BE40E04
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.F...t.]...v.....w.....y.....z.....|.:...}.k.............................................................................).....i...........e...........G.....y.............................}...... .....!.....!....D#....z$.....%....H%....I&....<'.....'.....'.....(.....).....*..../*....g+....k,.....,....V-...........0.....0....21....S2....i3.....4....O4.....5.....6....[7.....7.....8....5:.....;....d;.....<.... >.....?....m?....p@....9A.....A.....A.....B.....C.....D....<D....$E.....E....ZF.....F.....G.....H....UI.....I.....J.....K.....L....<L....*M.....N.....N.....N.....O.....P.....Q....KQ....ER....6S.....S.....S....>U.....V....kW.....W.....X.....Y.....Z....CZ....&[.....[....J\.....\....p]....Y^....$_....q_.....`.....a....+b.....b.....c....Nd.....d.....d.....f...."g.....g.....h.....i.....j....tk.....k.....m.....o.....q....Pq.....r.....s....nt.....t....Nv....tw....$x.....x.....y....vz.....z....6{....h|.....}....5~

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\te.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1359248
                                                                                                                                                                              Entropy (8bit):4.307321925100967
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:RG0y8Y7McKNW0yR5D7FgpC8ybtKRT5sbvkW3p/8WffhBp3p1FPnzTitlF2iDk7Pi:RGB+s5RNHFy
                                                                                                                                                                              MD5:A4ACCC25DD8A00BC57DF4FCA12E41295
                                                                                                                                                                              SHA1:9466888034C9E6ECF4113DDDA63D363ED20E3156
                                                                                                                                                                              SHA-256:157D646525F6A9AC267466631671E65E9B5C3E55B008B564186E64C6853E52AA
                                                                                                                                                                              SHA-512:F19116655B6C2BB5C572B45F1D712FA1F9D57D9E8963FB3D654ED3781BD34A4E937B590BCC1119A318E28632DA12A0EF8B36F6426791DE833898CF7F30189567
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.:...h.B...i.\...j.h...k.w...l.....n.....o.....p.....q.....r.....s.....t.....v.)...w.U...y.|...z.....|.....}.......+.....0.....8.....@.....H.....O.....V.....].....^....._.....d.......................^.......................D.................".....q............ ..... ....6!....s".....#....+$....f$....H%.....%....D&....y&.....'....X(.....(.....)....'*.....*....l+.....+....O-....y.....E/...../.....0.....1....e2.....2.....3.....4....i5.....5.....7....C8....A9....~9.....:....d<....D=.....=.....>....:?.....?.....?.....@.....A.....B....]B....qC....6D.....D.....D....3F.....G.....G.....H....5I.....J.....J.....J.....K.....L....>M.....M.....N....nO.....O....%P....KQ.....R.....R.....R....8T.....U.....U.....V.....W.....W.....X....`X....+Y.....Y.....Y....,Z.....Z.....[....h\.....\.....].....^....._....#`....$a.....a....4b.....b.....c.....d....#e....pe.....f....sg.....h....Vh....(j.....k.....l....!m.....n.....o....op.....p....6r....#s.....s.....t.....u.....u....?v.....v.....w.....x.....y

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\th.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1142703
                                                                                                                                                                              Entropy (8bit):4.350453098899463
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:X6cnN9LyZYAPTKznL/4svUSynUGevuB5Uz0dNL3fRj8NRU+wunRUdGILV+w11LAn:X05ANf
                                                                                                                                                                              MD5:B18E4574DB917920ECCFB8E6900D0662
                                                                                                                                                                              SHA1:554206B9E639135074B0946FB28B6FFE2D934159
                                                                                                                                                                              SHA-256:C14FA1BB30C880216D6CFEA6FB738235CF72A3FE8BE919C3D61321D5A5883211
                                                                                                                                                                              SHA-512:5F427F9ED85BB368B45BAFD523C634E18596E430FDC380563878D2CA897CF2580D0405F7C0D8E10ABBA389BB7125978A81D335263BB777E0EE0BFE3D47C8C65F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........'..e.8...h.@...i.H...j.S...k.b...l.h...o.p...p.}...q.....r.....s.....t.....v.....w.6...y.]...z.....|.....}.........................$.....,.....1.....9.....@.....G.....N.....P.....U.....y.................<.....M.....$.......................`.............................h.......................]...........P............ ....> ..... ....Z!.....!.....!.....".....#.....$.....$....y%.....&.....&.....&.....'....R(.....(.....(.....)....f*.....*.....*.....+....t,.....,.....-....F.....5/...../....30.....1.....1.....1....82.....3.....3.....4....@4.....5.....5.....5.....6.....6.....7.....8....A8.....9.....9....4:....X:....$;.....;....E<....l<.....=.....=.....>..../>.....?.....?....%@....L@....fA....cB....'C....OC.....D.....D.....D.....E.....E....JF.....F.....F....hG.....G....OH.....H.....I....TJ.....J....ZK.....K....oL.....L.....L.....M....<N.....N.....N.....O....KP.....P.....Q.....R.....R.....S.....S.....U.....V.....V....$W.....X.....X....HY....xY.....Z.....Z....![....@[....I\.....].....]

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\tr.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):581275
                                                                                                                                                                              Entropy (8bit):5.614415854351588
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:A9dM9N/9/UHzNsgkDQqZFtQSJ8kJ5MLJy:0eZb8kJ50Jy
                                                                                                                                                                              MD5:82C6A14BA1B28F947BEE67BC3FEAB091
                                                                                                                                                                              SHA1:25023B22EAED29D0817EC95D5BCB4AD3D724F5AD
                                                                                                                                                                              SHA-256:099507F6F2A2C98ECCE275F8AD956EEEEAADA65B7788356301AF04A0CD7D431E
                                                                                                                                                                              SHA-512:988A9275B7A05D100CA9242DD05969D2363A42938D47DB37A1F62EC1874E96B640C14B272F1829AB5C6E0D2763C22FBF0AF99894D4D9D32726925EABBC02C05E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.-...v.b...w.....y.....z.....|.....}.;.....d.....i.....q.....y...................................................................................k.................K................. .......................Y.......................].......................D.......................N...................................3.....P............ ....G ....X ..... .....!....6!....F!.....!....2"....u".....".....#.....#.....#.....#....D$.....$.....$.....$....D%.....%.....%.....%....A&.....&.....&.....&....A'.....'.....'.....'....T(.....(.....(.....)....b).....).....).....*...._*.....*.....*.....*....\+.....+.....+.....+.....,.....-....R-....k-.....-....1.....^.....z...........$/....F/....a/...../.....0....C0....U0.....0....,1....f1.....1.....1....52....T2....d2.....2....(3....S3....h3.....3....<4.....4.....4....C5.....5....[6....m6.....6....r7.....7.....7....o8.....8....)9....E9.....9.....:....9:....N:.....:....';....`;

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\uk.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):996487
                                                                                                                                                                              Entropy (8bit):4.873979205850633
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:1x/vKIH9mGGHWK9TddsSr+whF5gZrZEdIIXgOb5YB3Ijwl2Ab+rUcauHLNiXErqx:3/vXH9ynh5BrI
                                                                                                                                                                              MD5:EC3AA18A9D9C989B1025DDDB0FA52B55
                                                                                                                                                                              SHA1:AB3B0834CABEE34BC2F9FD04104B10E5F9C102CA
                                                                                                                                                                              SHA-256:EE67744C26E0C69FBED8B102ADD339070AABC70C2D8CA9EA037C6C9D23B66D3B
                                                                                                                                                                              SHA-512:90D40424B050C6C7ACE113E85B0B0A58472967C50A14FBC6637CD3B2DB8FF3F521CC94DCD256FA017684256E8A9C19B158AAA57F6D3094FAB970578D3B1C6847
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:........[(..e.t...h.|...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.Z...w.....y.....z.....|.....}.3.....\.....a.....i.....q.....y...........................................................7....."...........x...........\...........b...........W.............................&.................q...........X.....}...... ..... .....!.....!.....!....f".....".....".....#.....$....'%....c%.....&.....&.....'....5'.....'....t(.....(.....(.....)....a*.....*.....*.....+.....,....8-....r-..........k.................\/...../.....0....90.....0....81....v1.....1....H2.....2....F3....m3.....4.....4.....4.....4.....5.....6....R6....k6.....6....z7.....7.....7....n8.....8....<9....W9....P:.... ;.....;.....;....}<.....<....A=....c=.....=....9>....b>.....>....5?.....?....T@....o@....dA.....B.....B.....C.....C.....D....<D....iD.....E.....E.....E.....F.....F....]G.....G.....H.....H.....I....hJ.....J....wK....;L.....L.....M.....M....DN.....N.....N....EO.....O.....P.....P.....P.....Q.....R

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\ur.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):870809
                                                                                                                                                                              Entropy (8bit):5.161712117251234
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:wtiyilnG/Uo458PMzCR4FXdQLN9AyTibR45GO6EhTCWORJlbQYrMYVwadcJKwURn:Vyie5T5/Cgu
                                                                                                                                                                              MD5:CB228CC41981E8BCBD2768DA20026912
                                                                                                                                                                              SHA1:C55BB999C4C1FBEE5E38B6C986FBCE2B128F3880
                                                                                                                                                                              SHA-256:A7D825FE348700528800EF9EA7940EE8027373E9C05A4E51E526D0A213C05429
                                                                                                                                                                              SHA-512:85308806BE53494683F32520E181DD9C8C9ABAC0B92BC439D4E30EEF22D4AF993794A9719DD9A4EEED0BBCAF61C0E2342E7D4ED5D30B504572BD2BC269100E2E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(..e.....h.....i.....j.....k.!...l.,...n.4...o.9...p.F...q.L...r.X...s.....t.....v.....w.....y.&...z.T...|.{...}.........................................................................&.....@.....^...........Z.......................w.....!.......................G.......................N.................k...........7.....X...........g ..... ..... ....d!.....!....%"....R".....#.....#.....$....Q$.....$.....%.....%.....&.....&....L'.....'.....'.....(....W).....).....*.....*.....+....7,....h,.....,....H-.....-.....-....+.......................q/...../.....0....90.....0....Z1.....1.....1....a2.....2....A3...._3.....3....j4.....4.....4....U5.....5.....6....)6.....6....47.....7.....7....d8.....9.....9.....9....Q:.....:.....;....=;.....;.....<....K<....y<.....=.....=.....=.....=.....>....@?.....?.....?....x@.....@....%A....HA.....A.....B.....B.....B.....C....GD.....D.....D.....E....xF.....F....!G.....H.....H....-I....lI....7J.....J....4K....bK.....K....qL.....L.....L.....M.....N....oN

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\vi.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):689415
                                                                                                                                                                              Entropy (8bit):5.7905904014606335
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12288:v8/9MO+cGZoEK9VaZLlFK0FgxBxJbTsIxvx5a8h/9cDNUOnmzi0HRva8Z1lc:vSSO+cG6V4lE0uxHZH5a899yiOnwi01k
                                                                                                                                                                              MD5:045241A62232BAE57F1D57C6C3AF7C55
                                                                                                                                                                              SHA1:5C2A1A677A8BDFA20F3577335131BD4B89A46355
                                                                                                                                                                              SHA-256:56758C918BBFE6A9D5B20E8B4A7248BDF2D43E0BF5F98E85A9892FF03DBC2D99
                                                                                                                                                                              SHA-512:8E30AF44A53A36A194DA16A756DFF0F90EFBEF164277BDCDE683C89A3CDC04AE5E1298475E8A098D19DAB73EB0A71637F676D49D237C5480E1F7ACA1765166BB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:........P(..e.^...h.f...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.M...w.y...y.....z.....|.....}.&.....O.....T.....\.....d.....l.....s.....z...........................................................O.................r...........G.....^.......................*...........+.....}.................?.....e.....q...........G.................2.............................. .....!.....!.....!....?"....."....."..../#.....#.....#.....$.....$....;%.....%.....%....t&.....'....q'.....'.....(....o(.....(.....(....').....).....).....)....B*.....*.....*.....*.....+.....+....E,....\,.....,....2-....i-....z-.....-....D.....x.................Q/...../...../.....0....v0.....0.....0....r1.....2....x2.....2.....3.....3.....3.....3....V4.....4.....4...._5.....5.....6....+6.....6....h7.....7.....8.....8.....9....89....Z9.....9....W:.....:.....:....N;.....;.....<....+<.....<....s=.....=.....=.....>....Y?.....?.....?....u@.....@.....A....,A.....A.....A....2B....FB.....B....xC.....C.....C

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\zh-CN.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):496499
                                                                                                                                                                              Entropy (8bit):6.685741162993645
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:rr0PPN0s9IHFKwowzwAEM7i56Ez2bHy1t59Lo3/4oT2Paq8lc:XGNXUKwTzwx956Ez2bH05Nov4oTUV
                                                                                                                                                                              MD5:798BC7D8B63906C5B1C67E89AD17DC58
                                                                                                                                                                              SHA1:B39C86D6D3FD9D8B8DA90D86F827A0C0803FBA8C
                                                                                                                                                                              SHA-256:1C05280D8DCDFE99619695B76DD054292A90C1A93A5CFB92CDC4A5B0068A7092
                                                                                                                                                                              SHA-512:7A21AF438823D562B889D7C99F639421E01F0536E95F3206DD53D2C8DED82B7A4AB74BB9B4262B2FA27E50EFD8DD7719827AD2E6B6D4C2E0D0811930027ED982
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........(U.e.....h.....i.....j.....k.+...l.2...m.:...o.a...p.f...q.l...r.x...s.....t.....v.....w.....|.F...}.w.........................................................................................%...........6.......................U.......................\.......................e.......................d......................./.....V.....c.................6.....P...........+.....l.....~...........:.....n.....{........... .....I.....U.................;.....M..........." ....` ....r ..... .....!.....!....5!.....!.....!.....!.....!....D"....."....."....."....!#.....#.....#.....#....)$....{$.....$.....$.....%....a%.....%.....%.....%....?&....g&....s&.....&.....'....A'....M'.....'....3(....t(.....(.....(....#)....C)....W).....).....)....$*....;*.....*.....*.....+....(+.....+.....+.....,....),....u,.....,.....,.....,....E-.....-.....-.....-....E.......................a/...../.....0....,0.....0.....0....01....E1.....1.....1.....2....*2....v2.....2.....2.....2....H3.....3.....3.....3....D4

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\locales\zh-TW.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):491017
                                                                                                                                                                              Entropy (8bit):6.696102855635661
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:IpP3caOCTyemy5JPFW2uHu4u0JU52UznMi4LnKeze9Tk:qXvmOWzu0JU52UznUeC
                                                                                                                                                                              MD5:0BE25A48EECEE48F428FE56FBFA683FD
                                                                                                                                                                              SHA1:94C0E8C99BEB592EBAB9EA5B8758AA414BBE7048
                                                                                                                                                                              SHA-256:A5E276BDFE4CF87832EEE153596CCDE9CF9193E81F29A4295C8335525DA64295
                                                                                                                                                                              SHA-512:423033E67654820AB9F9773F45F70908511AEB8228C59126757885E0BBE0BD960257324D405D27526D61B541B1E6323DE16BEF29D4DCB94F39FD5E92FA811CC8
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:.........'..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.&...v.[...w.....y.....z.....|.....}.4.....].....b.....j.....r.....y.....................................................8.......................T.......................@.......................<.......................$.....y.......................J.....k.....x...........(.....N.....h...........%.....T.....i.................J.....W.................(.....4................./.....A.................W.....i.................. ..... ....g ..... ..... ..... ..../!....~!.....!.....!....."....X"....."....."....."....5#....^#....j#.....#.....$....M$....Y$.....$.....$....'%....0%.....%.....%.....&.....&....t&.....&.....'.....'....j'.....'.....'.....'....0(....v(.....(.....(....J)....t).....).....)....3*....d*.....*.....*.....+....!+....-+.....+.....+.....+.....,....s,.....,.....,.....-....|-.....-....=.....L............/....S/....h/...../.....0....G0....S0.....0.....0.....0.....0....M1.....1.....1.....1....=2.....2

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources.pak

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5755390
                                                                                                                                                                              Entropy (8bit):7.996220000544904
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:98304:JZ5ti6+nkrht455GGPeenn0mJSwLEpxIvMi8rwrGU3nAaqdkmYAzFKwR4:j7ilnkrP455GGHnhEXU8kr1Xqdf1FvG
                                                                                                                                                                              MD5:6772B597BF68622D934F207570E771B1
                                                                                                                                                                              SHA1:F2A80FBFA034CB1FA07DC9AA37BF9F5B2280FF13
                                                                                                                                                                              SHA-256:268DE4D99AB7C4F4EE32C8E8CB2B058A2C8D0D839F468AE8E8C0605FEAA736EA
                                                                                                                                                                              SHA-512:A2BE67DF09951C9EF9200DCCCBDFF13736921522191F0001DA539D5C7F26B5B26A6B810BE6963908F216768C98D21E52486C7E00538CC0730E8C78E78811B85B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:............f..#..{.V...|.*1..~..4....OG....aI................V...........@..............................................D9....Dc....D.....D.....D.....D.....D,....D" ...D*$...D.$..HE.$..IE.(..JEx*..SE-/..TE.8..UE.G..VE.h..\E.q..]E.r..^E.s..`E*t..aEty..bE....cExo..dE.Z..eE.[...E.\...E.m...Eho...Exs...E.u...E.{...E.....E....E.....E.....E[....E....EV....E.....E.....E7....E.....E.....E2....E.....L9....L.....L.....L+....LP....L.....L(.../Lo...0L5...1L,)..2L.3...Q.D...Q.P...QdY...Q.\...Q._...Q.j...Q.k...Q.l...QAn...Q.....Q.....R.....R....ZdA&..[d"(..\d:=..]d.@..^dpA.._d3D..`d.G..adqI...d.T...d.Y...d._...d.m...d.p...dUu...d.v...d.x...d.y...d.|...d;....d....6eL...7e|...8e...9e5...:e....;e....<e....=e....>e#...?e....@eo...Ae....Be=...Cex....gp....ga0...g.2.....3.....6.....*....X+.....2.....2.....4.....9.....L....K...........a.....g.....9.....Y.................7... .>...<..L..=..M..>..S..?..X..@.cZ..B.]g..C..i..D..s..E..v..F..w..G.i...H.....I.....J.....K.]...L.....M.....N.S...O._...P.L...Q...

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):11930143
                                                                                                                                                                              Entropy (8bit):6.847204824927118
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:98304:TM8gj5wrFTmZ1pGGzpEQTEbFSTc99qkx/vAb2cWd:Tq5wrFTmZ1pGGzpEQyYcntIb2cs
                                                                                                                                                                              MD5:2D2E634D2A3D9593D69E3D39907DD40C
                                                                                                                                                                              SHA1:4D27F0B39E971AC76C4103720227FF84BA64A443
                                                                                                                                                                              SHA-256:6442B92CA87F0B448495AB5167129DEEEB8AD644F2E5B9CCF37EB0C637274852
                                                                                                                                                                              SHA-512:BFC720E39FDC060971B51F0B1D57C1A2A119432A2D3DD65E6457C9BF67EDCD3E7597D3FC53CEC2A9DCA7D883DF3791D80EEB2850E494F8AEEE1AB108DD0C7573
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:....P...L...G...{"files":{"node_modules":{"files":{"@babel":{"files":{"generator":{"files":{"LICENSE":{"size":1106,"integrity":{"algorithm":"SHA256","hash":"117da2af0d4ce0fe1c8e19b5cff9dcd806adf973d328d27b11d4448c4ff24f76","blockSize":4194304,"blocks":["117da2af0d4ce0fe1c8e19b5cff9dcd806adf973d328d27b11d4448c4ff24f76"]},"offset":"0"},"lib":{"files":{"buffer.js":{"size":5771,"integrity":{"algorithm":"SHA256","hash":"49d70448373ee7293d57c661383f44e86174059be60d2f8fb98969ae97f16e5e","blockSize":4194304,"blocks":["49d70448373ee7293d57c661383f44e86174059be60d2f8fb98969ae97f16e5e"]},"offset":"1106"},"generators":{"files":{"base.js":{"size":2294,"integrity":{"algorithm":"SHA256","hash":"fb4891bbcaf0f27846b193500bc944213e7cbf2c0feb282795b153d70282e000","blockSize":4194304,"blocks":["fb4891bbcaf0f27846b193500bc944213e7cbf2c0feb282795b153d70282e000"]},"offset":"6877"},"classes.js":{"size":4157,"integrity":{"algorithm":"SHA256","hash":"7f9a3208c888e8ef986bf7cb79a5143fd8bb51308ca17bad9e0a5be0c5251

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\index.js

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:Java source, ASCII text
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4000
                                                                                                                                                                              Entropy (8bit):5.348928984866719
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:umC8wdGAK449W7zAaTkSZPXRS/hLfFBZ8tAemaPe6QaiiFVlPXRYaPJyPXCRy04:93/Gbk4BS5fFL82emJaii/hBLPkXCRyR
                                                                                                                                                                              MD5:884E837BDA065828A42D633F81CDFAD5
                                                                                                                                                                              SHA1:C1768675091EA6139B90E53853420CCEF9C09A4C
                                                                                                                                                                              SHA-256:B7AC5FA0D24DF44755481B9876850FED593423D68C48EED9D30E989879B1864B
                                                                                                                                                                              SHA-512:A43BD95B227BA0158A0005A9BFEC6DFDD3AD1CD85BCFBAF37681A7664B4D66E834BDD33484251374F791B5A5D7CBE2DC5CB26BAF0E029712F8977CB5509B9852
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:import process from 'node:process';.import {promisify} from 'node:util';.import path from 'node:path';.import {fileURLToPath} from 'node:url';.import childProcess from 'node:child_process';..const __dirname = path.dirname(fileURLToPath(import.meta.url));..const TEN_MEGABYTES = 1000 * 1000 * 10;.const execFile = promisify(childProcess.execFile);..const windows = async () => {..// Source: https://github.com/MarkTiedemann/fastlist..let binary;..switch (process.arch) {...case 'x64':....binary = 'fastlist-0.3.0-x64.exe';....break;...case 'ia32':....binary = 'fastlist-0.3.0-x86.exe';....break;...default:....throw new Error(`Unsupported architecture: ${process.arch}`);..}...const binaryPath = path.join(__dirname, 'vendor', binary);..const {stdout} = await execFile(binaryPath, {...maxBuffer: TEN_MEGABYTES,...windowsHide: true,..});...return stdout....trim()....split('\r\n')....map(line => line.split('\t'))....map(([pid, ppid, name]) => ({....pid: Number.parseInt(pid, 10),....ppid: Number.parse

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\license

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:ASCII text, with very long lines (460)
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1117
                                                                                                                                                                              Entropy (8bit):5.079903213409815
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:FHr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:FH8JplPvEDvQHcs5ITc3omFD
                                                                                                                                                                              MD5:D5F2A6DD0192DCC7C833E50BB9017337
                                                                                                                                                                              SHA1:80674912E3033BE358331910BA27D5812369C2FC
                                                                                                                                                                              SHA-256:5C932D88256B4AB958F64A856FA48E8BD1F55BC1D96B8149C65689E0C61789D3
                                                                                                                                                                              SHA-512:D1F336FF272BC6B96DC9A04A7D0EF8F02936DD594F514060340478EE575FE01D55FC7A174DF5814A4FAF72C8462B012998ECA7BB898E3F9A3E87205FB9135AF2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\package.json

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):606
                                                                                                                                                                              Entropy (8bit):4.677493590111802
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:/r1JPknYwUj+T4SHtGwwnH/h6lGP9pek/GacG1GOcIretJYM+ROA:z1JmUrS0JH/hRrsOreJA
                                                                                                                                                                              MD5:0D66A224C9A1C343842B7C97E5634EA6
                                                                                                                                                                              SHA1:83E8A14CFACEB5A522E91F057CB76FA98162F9A7
                                                                                                                                                                              SHA-256:B7A7AF79AE2225F7DEE5B160559468EFC4663CF8DFD2C6E9A068969CB089B003
                                                                                                                                                                              SHA-512:E071F659C7C433B55F0F1AED83AE63032618E522D11077DA83E32D9ED072A20B123CB8083129DF7201DD19BCB1D578D87EF256659B74D9E82A0934B725957F38
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:{. "name": "ps-list",. "version": "8.1.1",. "description": "Get running processes",. "license": "MIT",. "repository": "sindresorhus/ps-list",. "funding": "https://github.com/sponsors/sindresorhus",. "author": {. "name": "Sindre Sorhus",. "email": "sindresorhus@gmail.com",. "url": "https://sindresorhus.com". },. "type": "module",. "exports": "./index.js",. "users": {. "node": "^12.20.0 || ^14.13.1 || >=16.0.0". },. "files": [. "index.js",. "index.d.ts",. "vendor/*.exe". ],. "devDependencies": {. "ava": "^3.15.0",. "tsd": "^0.18.0",. "xo": "^0.46.4". }.}

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):271872
                                                                                                                                                                              Entropy (8bit):6.267941112452071
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:JxxmnATc41sT3iVSd87fqCHeohyRDaFsIh:3xmnz41s+VSsfT+o
                                                                                                                                                                              MD5:F92F454DE8ECEDD3945DBAEACD381DC3
                                                                                                                                                                              SHA1:ED4AA49E15795AC31F1E7CFAEF2E0C16359C5258
                                                                                                                                                                              SHA-256:D1A71F9AC1728082C1B276392725C3E010B98714888579B99152E401ABEDBF11
                                                                                                                                                                              SHA-512:312D62DA1F41E2B9FE0F15EF30D81A4241F309D83A24643EC8CB99104EF5EF7F52EC216C5CDF0E3995FC5B538DFDFC54E78FBDE3A57EB0AB8BD04DEC07CB5586
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h...,.n.,.n.,.n.w.m.&.n.w.j.>.n.w.k..n...j.<.n...m.&.n...k.}.n.w.o.).n.,.o.L.n..g.-.n....-.n..l.-.n.Rich,.n.........................PE..d......^..........".................D..........@..........................................`.....................................................(....`....... ...#...........p..,.......p..............................0............................................text...\........................... ..`.rdata...I.......J..................@..@.data....*..........................@....pdata...#... ...$..................@..@_RDATA.......P......................@..@.rsrc........`......................@..@.reloc..,....p......................@..B................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exe

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):215040
                                                                                                                                                                              Entropy (8bit):6.5588154485327355
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:MuP738wut5T2/efnO310+Hfd+ueCuMvMLAOgp+HQ:MuPL8wut5T2/eCHF+ueCQeQHQ
                                                                                                                                                                              MD5:3DE9EE7FE8CF4710DA1C8538A1BD86DF
                                                                                                                                                                              SHA1:6FF4B813AD66F0B013222FE044579511A79804D8
                                                                                                                                                                              SHA-256:017411F3B0B5C0402CC3B2CB87C32C6FC71ABD82E5B17EA6108990096C75A65D
                                                                                                                                                                              SHA-512:0AAB4D484DF289485BEB90EE8B7D929D2D6FA5D7E4385C17B2745DEA40E295F1A9C6C3C8C6C206B46F04A50B51EB01952793FFB84E978C9D0D7447435280ABE7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HY..)7..)7..)7.A4..)7.A2.Z)7.A3..)7.4F3..)7.4F4..)7.4F2.)7.A6..)7..)6.)7.yY>..)7.yY...)7.yY5..)7.Rich.)7.................PE..L......^.................$.........."z.......@....@.......................................@.................................L$..(....P.......................`... ......p...........................P...@............@..@............................text....".......$.................. ..`.rdata.......@.......(..............@..@.data........0......................@....rsrc........P.......$..............@..@.reloc... ...`..."...&..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\resources\elevate.exe

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):107520
                                                                                                                                                                              Entropy (8bit):6.442687067441468
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
                                                                                                                                                                              MD5:792B92C8AD13C46F27C7CED0810694DF
                                                                                                                                                                              SHA1:D8D449B92DE20A57DF722DF46435BA4553ECC802
                                                                                                                                                                              SHA-256:9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
                                                                                                                                                                              SHA-512:6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\snapshot_blob.bin

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):316538
                                                                                                                                                                              Entropy (8bit):4.177181507694743
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3072:p+JfFRciefJNlUMX2kIE1aOaVsS/3hYeFWYSITdJgClE+ceNTbM:pefPciePmMXh1aOCsy3hpFRlzVw
                                                                                                                                                                              MD5:C8950B01F336B05609976546B1A007E6
                                                                                                                                                                              SHA1:F04D0B0369007BBE6A7FE129B31B19DD1822F32F
                                                                                                                                                                              SHA-256:9B3A75A713E41BC73F219858FCAC8E3031BA22732285ED3A64DC48074C725CC2
                                                                                                                                                                              SHA-512:B7DB4277290E849A52AD5D31FF65AB5D2B75C2125D67EEEE02B09E4E7001AA46D10BF89429C65695C7560D1C45B898C20275EB9E36CD8B259707FFB8B298F103
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:..........(.._.13.0.245.16-electron.0..........................................`L..............l....K..}.a........a........a2.......aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\v8_context_snapshot.bin

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):687473
                                                                                                                                                                              Entropy (8bit):5.155441647860749
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:vPYRCOn2E6keR1PciePmMXh1aOCsy3hbHRlEDMrVkSiF01gwoHZHCvqmO9iXz8pk:vPY5nnbe3WZBr/iXo73nVE+2l
                                                                                                                                                                              MD5:BF2976DA5086B48D74EB36F56F5DEB83
                                                                                                                                                                              SHA1:5AA7669A3E2166FDD7534241A0E7A9BD3FF5748B
                                                                                                                                                                              SHA-256:9F1614328E18BECB4ADF96DE98BC91CE2A69274ABE6621327CC0FC8503A1AB20
                                                                                                                                                                              SHA-512:C44DEEB96597B4498604ECF2060EE0520E84A00308CA1F47FFDF8E3ED3E676B27B622FF7DBD4B6F1A14CE60B05CC2AD9B8D7562BB362C1B12A885EA7FBE50E0A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:...........a.na.13.0.245.16-electron.0..............................................!...i...1...q.......l...x...}.a........a........a........aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\vk_swiftshader.dll

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5533184
                                                                                                                                                                              Entropy (8bit):6.341413194477468
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:49152:zBVtMrKyOsxYYAKDsJS86IxORjgUlC3K/FAz4gdm6o4oX7uh5LC6MW4LY67h772c:jWKyOEnOnoLrWbfDiN9isC
                                                                                                                                                                              MD5:6720D5DCDA6737EB0CC5A352A47414DC
                                                                                                                                                                              SHA1:03D9A8E350F485DD955F7DEE06BFC46371753032
                                                                                                                                                                              SHA-256:D8F36B089D83157ABC271D9FE125919C3237943FA9789A511AC5EF1D41E2E3AF
                                                                                                                                                                              SHA-512:DE5ADE6CE14B14957FCE669C4181AF1E6A6F540798D1C6720B56FF281F813A6CE4446BDE33A8F175D2484E07F4911F93A773CAC1D372CBE3B26BE634B3FA1686
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......B.........P.;.......................................U...........`A..........................................O.......O.P....PU.......S..W...........`U.......O......................O.(.....B.@.............P.8............................text...g.B.......B................. ..`.rdata........B.......B.............@..@.data...H.....P.......P.............@....pdata...W....S..X...VR.............@..@.gxfg...0.....T..0....S.............@..@.retplne..... U.......S..................tls....Y....0U.......S.............@..._RDATA.......@U.......S.............@..@.rsrc........PU.......S.............@..@.reloc.......`U.......S.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\vk_swiftshader_icd.json

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):106
                                                                                                                                                                              Entropy (8bit):4.724752649036734
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                              MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                              SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                              SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                              SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\7z-out\vulkan-1.dll

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):894976
                                                                                                                                                                              Entropy (8bit):6.60309283089771
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24576:FhJnfYUcguY3cTAL6Z5WjDYsHy6g3P0zAk7TNb:FhVrXN3oAL6Z5WjDYsHy6g3P0zAk7T
                                                                                                                                                                              MD5:B6D3AF84E8BE0027741AA6077768789E
                                                                                                                                                                              SHA1:E525F2434DC56F79644695F5841E91DD5F80EEC4
                                                                                                                                                                              SHA-256:376FF6892EC7B406ACD8C455AC82F8541E59E3757195488FF04CD9F20D554562
                                                                                                                                                                              SHA-512:F03B8792A740679C8A1A8CE0615B7876CC811130085F3FFB42182E0CB846519603804DA97FC93A8ABEBEE01E03FD257DF289C54575DA8FAAAD018F4F4BAE606A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .........................................................@............`A........................................PL..<!...m..P.... .......P..ha...........0..$....:.......................9..(.......@............q...............................text............................... ..`.rdata..............................@..@.data....L......."..................@....pdata..ha...P...b..................@..@.gxfg....%.......&...j..............@..@.retplne.................................tls................................@..._RDATA..............................@..@.rsrc........ ......................@..@.reloc..$....0......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\SpiderBanner.dll

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):9216
                                                                                                                                                                              Entropy (8bit):5.5347224014600345
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
                                                                                                                                                                              MD5:17309E33B596BA3A5693B4D3E85CF8D7
                                                                                                                                                                              SHA1:7D361836CF53DF42021C7F2B148AEC9458818C01
                                                                                                                                                                              SHA-256:996A259E53CA18B89EC36D038C40148957C978C0FD600A268497D4C92F882A93
                                                                                                                                                                              SHA-512:1ABAC3CE4F2D5E4A635162E16CF9125E059BA1539F70086C2D71CD00D41A6E2A54D468E6F37792E55A822D7082FB388B8DFECC79B59226BBB047B7D28D44D298
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../../../..Wy./../../....../..Wi./..Wx./..W~./..W{./..Rich./..................PE..L...T{mW...........!................p!.......0...............................p............@..........................5..o...l1..P....P.......................`.......................................................0...............................text............................... ..`.rdata.......0......................@..@.data........@......................@....rsrc........P......................@..@.reloc..d....`....... ..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\StdUtils.dll

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):102400
                                                                                                                                                                              Entropy (8bit):6.729923587623207
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
                                                                                                                                                                              MD5:C6A6E03F77C313B267498515488C5740
                                                                                                                                                                              SHA1:3D49FC2784B9450962ED6B82B46E9C3C957D7C15
                                                                                                                                                                              SHA-256:B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
                                                                                                                                                                              SHA-512:9870C5879F7B72836805088079AD5BBAFCB59FC3D9127F2160D4EC3D6E88D3CC8EBE5A9F5D20A4720FE6407C1336EF10F33B2B9621BC587E930D4CBACF337803
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q....C...C...C...C...C...C...C...C...C...C...C...C...C.[.C...C.[.C...C.[.C...C.[.C...CRich...C........................PE..L...I..[...........!.....*...b...............@.......................................+....@..........................}..d....t..........X............................................................................@...............................text....).......*.................. ..`.rdata..TC...@...D..................@..@.data...l............r..............@....rsrc...X............x..............@..@.reloc..j............~..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\System.dll

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):12288
                                                                                                                                                                              Entropy (8bit):5.719859767584478
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
                                                                                                                                                                              MD5:0D7AD4F45DC6F5AA87F606D0331C6901
                                                                                                                                                                              SHA1:48DF0911F0484CBE2A8CDD5362140B63C41EE457
                                                                                                                                                                              SHA-256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
                                                                                                                                                                              SHA-512:C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\app-64.7z

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:7-zip archive data, version 0.4
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):86108360
                                                                                                                                                                              Entropy (8bit):7.999996269102668
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1572864:a2/ebAbWsL+/5FLl9Noabh+XJhXhQiB1dJdYVkq7U4hmfiGW5:k0bu5hl9OOh01VJY+qw0uiT5
                                                                                                                                                                              MD5:50FA2EE0FAF16367F635CC4BCC474EF7
                                                                                                                                                                              SHA1:0F2177987A6F48D736A73EFFACAA4CE84571E153
                                                                                                                                                                              SHA-256:163B44F1FA2CE29B30607E44D8C59998749007D055F5A90BF2B8ACD90DE0D4F1
                                                                                                                                                                              SHA-512:040D9AE055368EBE31A59BB31AD5617A693681DD329DCAFA176BBC6F8F4B6915F9732F7B5290F48EAC186BF665A1A5B654FCA2599D1F2A73B358437EEA59A4EF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:7z..'...7xz..!.....%...............]...6.....#.0@.1.zL..[...4b ...A....Z7.~...........}.......m.7!*Q..X,s..T...>~(|.s..%...1`.Yw......vK.Tz.|pu.96...D.......w,2PO;I..Z.{..I..y.pn...P..*G.a...Z...(....R..R8|.\....L...k..}..s&.'.....0.."o.s.ZI.=.(.C.?.Gg...|..^....;.e[.w....<.n.@..&Z...$`p ..OzD...V..r.l...ibH..hv."6.m.5.T{*4nh.....Sx.G..1.'.....8.."..................Zk!`.fd..qN.....{.......O.$.|r.{.a|^.]..K*n..t..e.......o.s.v}.....2[M..1..yG..]Y. ...Z=....?.\#*..)...!k...X....G.%>......t..7.}.G.~HV..D.[.....4....!.....=.r.../P.5*..j1^.!..W).!...J.!H0....Rj..[..0.y.u...5..bC...\..{...Cv...`xN|....2m.A.{..m..y).*B.q.D.y...j.\.R#.CX\n..L>.NN.]..cj{>..p.j}.&..Z<.`7....o.......k..z.. ...?..~g.|m....kysn.q.., b>'.:,p...... .......V..x........0j.......F..3....W.......xO.....w.q..a....s.4#.GWP.........r'...K....+_^"0T=.+.....u)......xEP.Il.}.P>.@{.9{.......*...Q..E..[..[34..wx....Z...$..U.....vg....k.......Z.$j....#.b.rF....#5...XO.u...saZ...'.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\nsExec.dll

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):6656
                                                                                                                                                                              Entropy (8bit):5.155286976455086
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
                                                                                                                                                                              MD5:EC0504E6B8A11D5AAD43B296BEEB84B2
                                                                                                                                                                              SHA1:91B5CE085130C8C7194D66B2439EC9E1C206497C
                                                                                                                                                                              SHA-256:5D9CEB1CE5F35AEA5F9E5A0C0EDEEEC04DFEFE0C77890C80C70E98209B58B962
                                                                                                                                                                              SHA-512:3F918F1B47E8A919CBE51EB17DC30ACC8CFC18E743A1BAE5B787D0DB7D26038DC1210BE98BF5BA3BE8D6ED896DBBD7AC3D13E66454A98B2A38C7E69DAD30BB57
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....~.\...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrDD4.tmp\nsis7z.dll

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):434176
                                                                                                                                                                              Entropy (8bit):6.584811966667578
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
                                                                                                                                                                              MD5:80E44CE4895304C6A3A831310FBF8CD0
                                                                                                                                                                              SHA1:36BD49AE21C460BE5753A904B4501F1ABCA53508
                                                                                                                                                                              SHA-256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
                                                                                                                                                                              SHA-512:C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Nov 14 17:45:33 2024, mtime=Thu Nov 14 17:45:45 2024, atime=Thu Nov 14 09:40:50 2024, length=188819968, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1165
                                                                                                                                                                              Entropy (8bit):4.9127960808319315
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:8HHW4DmlXZXARgT4NlWaSlWdAoanGglWGlWz73vqygm:8HHrDmlpQRgT43W5NnGgNAGyg
                                                                                                                                                                              MD5:4478D01F0F16D25E734EEF1BC47B0870
                                                                                                                                                                              SHA1:77A6DBF7980FCDD64CA86FFF597B74158433496B
                                                                                                                                                                              SHA-256:FC24E81697524212DBC016011C3D174B00D8C828E9CD28F9366B742881E94C8F
                                                                                                                                                                              SHA-512:8E157074DC45C4DC4B855ED932CECF0CEAB5E7517F74A365954DC0A97402FB0DB60B80F03E94754166AB18B947C36148B311B7FF06234399B336F34C7ACBC78F
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Preview:L..................F.... ...P.>c.6...8.i.6.....6...*A.......................:..DG..Yr?.D..U..k0.&...&.......$..S....k7N.6..}..k.6......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2nY.............................^.A.p.p.D.a.t.a...B.P.1.....nY....Local.<......EW<2nY......[.....................Du..L.o.c.a.l.....Z.1.....nY....Programs..B......nY..nY......f ....................3...P.r.o.g.r.a.m.s.....P.1.....nY....Teams.<......nY..nY......j .......................T.e.a.m.s.....\.2..*A.nY.U .Teams.exe.D......nY..nY................................T.e.a.m.s...e.x.e.......g...............-.......f.............6......C:\Users\user\AppData\Local\Programs\Teams\Teams.exe..0.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.T.e.a.m.s.\.T.e.a.m.s...e.x.e.............:...........|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... .)..Jc...-...-$..hT..CrF.f4... .)..Jc...-...-$.............1SPS.XF.L8C....&.m.q............/...

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Teams\Local State (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):434
                                                                                                                                                                              Entropy (8bit):5.610728844391146
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:YKWSCuj9rrt++ikJAPNfMRXzmwni++2aPZoEV:YKWJu5rrtjSPOXzm8aR
                                                                                                                                                                              MD5:638829FCB773F745DA90EF7930100F34
                                                                                                                                                                              SHA1:8A372373C22305D0F22D75D3316B0532A631959C
                                                                                                                                                                              SHA-256:7A582A625BC3BEA60AF751A85F7D392C1828D2032ADDE2073D079E9520E4D00E
                                                                                                                                                                              SHA-512:B5BE9E34B5CBEB27C83211F2CE7FF138E12292382432A6AEB55E69A9E1256C07A8D6A3928D89CC57E8C24C900EB3B2B5A901547692591DD31952F24D9C9C19AA
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAbAqb3GINJQqsgT4l64EUMEAAAABIAAABDAGgAcgBvAG0AaQB1AG0AAAAQZgAAAAEAACAAAABv79UBye7rAWbCmIa+xz29UmgnH3IpzGMpKDmBi5y5OQAAAAAOgAAAAAIAACAAAAAMOOV7ffgpvaLJO1KT1sVM82YYLTA4wofGceQypDbgdjAAAABSqDZs+XrbKNb/gAl1cpTFymrMTARDvcAe/jawoKmFGKSGLY//fu+jRakjmXZVjvtAAAAA44yk27u8Az2nk/xwZfIu+rEZNlqjvPoisyGDvcG/u1jy0refSdkude3exusjcQU+tVaFMAx12LQBFKvSj6NeoQ=="}}

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Teams\config.json

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):73
                                                                                                                                                                              Entropy (8bit):4.601969723287757
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3:NBH1UgBbGUI8TUmTdK8BHEKY:L1U0vUmTk8BHEKY
                                                                                                                                                                              MD5:753AF8BE23E81C98482D72D92E523EA7
                                                                                                                                                                              SHA1:BEE8E0418A9D6DFB8DB4FFF58C3DA8B8AFF47A74
                                                                                                                                                                              SHA-256:B46B707E359679D3B19D6A2741A6D29FAC425316396C4C4AA4FCD20C1B61F8FF
                                                                                                                                                                              SHA-512:326DF2AA3D622D5F03DFA3EBFEC7F71EF4EB5FCD8268D32C9A6B420EB66A506FDEDDF70B32F91093CFB56F19B909A59EF1B8CB18031569ED3F3AF9941591E78F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:{. "uuid": "36763ca7-4cf1-4561-8c36-863df177598f",. "installed": true.}

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Teams\d1e49bef-63fd-4ae4-b73e-c9b78c311b0e.tmp

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                              Category:modified
                                                                                                                                                                              Size (bytes):434
                                                                                                                                                                              Entropy (8bit):5.610728844391146
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:YKWSCuj9rrt++ikJAPNfMRXzmwni++2aPZoEV:YKWJu5rrtjSPOXzm8aR
                                                                                                                                                                              MD5:638829FCB773F745DA90EF7930100F34
                                                                                                                                                                              SHA1:8A372373C22305D0F22D75D3316B0532A631959C
                                                                                                                                                                              SHA-256:7A582A625BC3BEA60AF751A85F7D392C1828D2032ADDE2073D079E9520E4D00E
                                                                                                                                                                              SHA-512:B5BE9E34B5CBEB27C83211F2CE7FF138E12292382432A6AEB55E69A9E1256C07A8D6A3928D89CC57E8C24C900EB3B2B5A901547692591DD31952F24D9C9C19AA
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAbAqb3GINJQqsgT4l64EUMEAAAABIAAABDAGgAcgBvAG0AaQB1AG0AAAAQZgAAAAEAACAAAABv79UBye7rAWbCmIa+xz29UmgnH3IpzGMpKDmBi5y5OQAAAAAOgAAAAAIAACAAAAAMOOV7ffgpvaLJO1KT1sVM82YYLTA4wofGceQypDbgdjAAAABSqDZs+XrbKNb/gAl1cpTFymrMTARDvcAe/jawoKmFGKSGLY//fu+jRakjmXZVjvtAAAAA44yk27u8Az2nk/xwZfIu+rEZNlqjvPoisyGDvcG/u1jy0refSdkude3exusjcQU+tVaFMAx12LQBFKvSj6NeoQ=="}}

                                                                                                                                                                              \Device\Null

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                              File Type:ASCII text, with very long lines (427)
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):903
                                                                                                                                                                              Entropy (8bit):4.886122527102892
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:GSCUUC7QdaIWEJdWdV+saIWEJxSqzDttrdsSjN00L/WUu5QAmH+NcczIXoeZC+F:GmUKQdahz+sawDxsvE/xmQoNcckXoex
                                                                                                                                                                              MD5:D0C95C9064CB62A075512A65B21596D9
                                                                                                                                                                              SHA1:EE9614B24FD20DF6F20E1F61E9C161DD71FC5BF5
                                                                                                                                                                              SHA-256:DB7ECF611DA2426CA8B0993901FDFB5ECF969E9936BDE32CC6671EB278821149
                                                                                                                                                                              SHA-512:9AFDE534AE8BBA3BBCF4D911506625497B286C74D6807357B811BB63014AB42A94A815F3FB3AEEA5CB2559351A962041B2451F17DFA7FE2DFCBE478610564B3A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Preview:(node:1060) UnhandledPromiseRejectionWarning: TypeError: Cannot read properties of undefined (reading 'model'). at getSystemInfo (C:\Users\user\AppData\Local\Programs\Teams\resources\app.asar\main.js:50:31). at App.<anonymous> (C:\Users\user\AppData\Local\Programs\Teams\resources\app.asar\main.js:329:24). at process.processTicksAndRejections (node:internal/process/task_queues:95:5).(Use `Teams --trace-warnings ...` to show where the warning was created).(node:1060) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag `--unhandled-rejections=strict` (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 1).

                                                                                                                                                                              Static File Info

                                                                                                                                                                              General

                                                                                                                                                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                              Entropy (8bit):7.999770167797606
                                                                                                                                                                              TrID:
                                                                                                                                                                              • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                              • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                              File name:cMqyGFCQHk.exe
                                                                                                                                                                              File size:86'797'392 bytes
                                                                                                                                                                              MD5:b408e3da98f0e457d627510165374ddd
                                                                                                                                                                              SHA1:49de055d881896670ce8b1ba1633d5f8b4f8e193
                                                                                                                                                                              SHA256:3c3f458400c557d279c4d4993f67adc8ba3da4bad8fc844adfef8c7de475a1f7
                                                                                                                                                                              SHA512:3a092bd3ec86a4793a94b0e7b0dd50f50a1b9ea6c65b0628e912b7df967e267b236dbbee6b7d4fbc9deed6c5bc879ec5c2ee5f7bfe9460ec75121ebdfe7a4a73
                                                                                                                                                                              SSDEEP:1572864:4k2/ebAbWsL+/5FLl9Noabh+XJhXhQiB1dJdYVkq7U4hmfiGWk:4G0bu5hl9OOh01VJY+qw0uiTk
                                                                                                                                                                              TLSH:5E1833980792C262D3E414B8E5F363FB31027E1A8B351A993124B6DCF6271DA15B58FF
                                                                                                                                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

                                                                                                                                                                              File Icon

                                                                                                                                                                              Icon Hash:4c4f64e46464070e

                                                                                                                                                                              Static PE Info

                                                                                                                                                                              General

                                                                                                                                                                              Entrypoint:0x40338f
                                                                                                                                                                              Entrypoint Section:.text
                                                                                                                                                                              Digitally signed:true
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              Subsystem:windows gui
                                                                                                                                                                              Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                              Time Stamp:0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
                                                                                                                                                                              TLS Callbacks:
                                                                                                                                                                              CLR (.Net) Version:
                                                                                                                                                                              OS Version Major:4
                                                                                                                                                                              OS Version Minor:0
                                                                                                                                                                              File Version Major:4
                                                                                                                                                                              File Version Minor:0
                                                                                                                                                                              Subsystem Version Major:4
                                                                                                                                                                              Subsystem Version Minor:0
                                                                                                                                                                              Import Hash:b34f154ec913d2d2c435cbd644e91687

                                                                                                                                                                              Authenticode Signature

                                                                                                                                                                              Signature Valid:false
                                                                                                                                                                              Signature Issuer:CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
                                                                                                                                                                              Signature Validation Error:A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file
                                                                                                                                                                              Error Number:-2146762495
                                                                                                                                                                              Not Before, Not After
                                                                                                                                                                              • 15/10/2024 20:29:09 16/10/2025 20:29:09
                                                                                                                                                                              Subject Chain
                                                                                                                                                                              • CN="Lion Software, LLC", O="Lion Software, LLC", STREET=60 County Road 537, L=Centre, S=Alabama, C=US, OID.1.3.6.1.4.1.311.60.2.1.2=Alabama, OID.1.3.6.1.4.1.311.60.2.1.3=US, SERIALNUMBER=000-541-240, OID.2.5.4.15=Private Organization
                                                                                                                                                                              Version:3
                                                                                                                                                                              Thumbprint MD5:AC575FB5F87D72747656ED9FFBAEB0DA
                                                                                                                                                                              Thumbprint SHA-1:A243692CD9205CFE32BEEF144B7D84350F3AA0E6
                                                                                                                                                                              Thumbprint SHA-256:482DFF658DB3FF3B08ED60A99B5434DE6E8CF3F1DCB782831AA0B22978F7C49D
                                                                                                                                                                              Serial:1AF0A44396DD57AC87ECB79D

                                                                                                                                                                              Entrypoint Preview

                                                                                                                                                                              Instruction
                                                                                                                                                                              sub esp, 000002D4h
                                                                                                                                                                              push ebx
                                                                                                                                                                              push esi
                                                                                                                                                                              push edi
                                                                                                                                                                              push 00000020h
                                                                                                                                                                              pop edi
                                                                                                                                                                              xor ebx, ebx
                                                                                                                                                                              push 00008001h
                                                                                                                                                                              mov dword ptr [esp+14h], ebx
                                                                                                                                                                              mov dword ptr [esp+10h], 0040A2E0h
                                                                                                                                                                              mov dword ptr [esp+1Ch], ebx
                                                                                                                                                                              call dword ptr [004080A8h]
                                                                                                                                                                              call dword ptr [004080A4h]
                                                                                                                                                                              and eax, BFFFFFFFh
                                                                                                                                                                              cmp ax, 00000006h
                                                                                                                                                                              mov dword ptr [0047AEECh], eax
                                                                                                                                                                              je 00007F33B8C90283h
                                                                                                                                                                              push ebx
                                                                                                                                                                              call 00007F33B8C93535h
                                                                                                                                                                              cmp eax, ebx
                                                                                                                                                                              je 00007F33B8C90279h
                                                                                                                                                                              push 00000C00h
                                                                                                                                                                              call eax
                                                                                                                                                                              mov esi, 004082B0h
                                                                                                                                                                              push esi
                                                                                                                                                                              call 00007F33B8C934AFh
                                                                                                                                                                              push esi
                                                                                                                                                                              call dword ptr [00408150h]
                                                                                                                                                                              lea esi, dword ptr [esi+eax+01h]
                                                                                                                                                                              cmp byte ptr [esi], 00000000h
                                                                                                                                                                              jne 00007F33B8C9025Ch
                                                                                                                                                                              push 0000000Ah
                                                                                                                                                                              call 00007F33B8C93508h
                                                                                                                                                                              push 00000008h
                                                                                                                                                                              call 00007F33B8C93501h
                                                                                                                                                                              push 00000006h
                                                                                                                                                                              mov dword ptr [0047AEE4h], eax
                                                                                                                                                                              call 00007F33B8C934F5h
                                                                                                                                                                              cmp eax, ebx
                                                                                                                                                                              je 00007F33B8C90281h
                                                                                                                                                                              push 0000001Eh
                                                                                                                                                                              call eax
                                                                                                                                                                              test eax, eax
                                                                                                                                                                              je 00007F33B8C90279h
                                                                                                                                                                              or byte ptr [0047AEEFh], 00000040h
                                                                                                                                                                              push ebp
                                                                                                                                                                              call dword ptr [00408044h]
                                                                                                                                                                              push ebx
                                                                                                                                                                              call dword ptr [004082A0h]
                                                                                                                                                                              mov dword ptr [0047AFB8h], eax
                                                                                                                                                                              push ebx
                                                                                                                                                                              lea eax, dword ptr [esp+34h]
                                                                                                                                                                              push 000002B4h
                                                                                                                                                                              push eax
                                                                                                                                                                              push ebx
                                                                                                                                                                              push 00440208h
                                                                                                                                                                              call dword ptr [00408188h]
                                                                                                                                                                              push 0040A2C8h

                                                                                                                                                                              Rich Headers

                                                                                                                                                                              Programming Language:
                                                                                                                                                                              • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                                                              Data Directories

                                                                                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x19f0000x2c4d8.rsrc
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x52c5a280x1228
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                              Sections

                                                                                                                                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                              .text0x10000x66270x68007618d4c0cd8bb67ea9595b4266b3a91fFalse0.6646259014423077data6.450282348506287IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                              .rdata0x80000x14a20x1600eecac1fed9cc6b447d50940d178404d8False0.4405184659090909data5.025178929113415IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                              .data0xa0000x70ff80x600db8f31a08a2242d80c29e1f9500c6527False0.5182291666666666data4.037117731448378IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                              .ndata0x7b0000x1240000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                              .rsrc0x19f0000x2c4d80x2c60017ecf0cb331acf3e0aa34f7130f91d58False0.20090779049295773data4.330797014530664IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                              Resources

                                                                                                                                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                              RT_ICON0x19f7d80x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 38016EnglishUnited States0.10857683413916334
                                                                                                                                                                              RT_ICON0x1a8c800x67e8Device independent bitmap graphic, 80 x 160 x 32, image size 26560EnglishUnited States0.11736842105263158
                                                                                                                                                                              RT_ICON0x1af4680x5488Device independent bitmap graphic, 72 x 144 x 32, image size 21600EnglishUnited States0.1307301293900185
                                                                                                                                                                              RT_ICON0x1b48f00x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States0.1379900803023146
                                                                                                                                                                              RT_ICON0x1b8b180x3a48Device independent bitmap graphic, 60 x 120 x 32, image size 14880EnglishUnited States0.14711796246648792
                                                                                                                                                                              RT_ICON0x1bc5600x3524PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9886062922669803
                                                                                                                                                                              RT_ICON0x1bfa880x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.18443983402489628
                                                                                                                                                                              RT_ICON0x1c20300x1a68Device independent bitmap graphic, 40 x 80 x 32, image size 6720EnglishUnited States0.20310650887573964
                                                                                                                                                                              RT_ICON0x1c3a980x1628Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colorsEnglishUnited States0.24876586741889986
                                                                                                                                                                              RT_ICON0x1c50c00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.08864915572232646
                                                                                                                                                                              RT_ICON0x1c61680xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishUnited States0.298773987206823
                                                                                                                                                                              RT_ICON0x1c70100x988Device independent bitmap graphic, 24 x 48 x 32, image size 2400EnglishUnited States0.125
                                                                                                                                                                              RT_ICON0x1c79980x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishUnited States0.1565884476534296
                                                                                                                                                                              RT_ICON0x1c82400x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 1680EnglishUnited States0.13895348837209304
                                                                                                                                                                              RT_ICON0x1c88f80x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishUnited States0.16329479768786126
                                                                                                                                                                              RT_ICON0x1c8e600x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.17819148936170212
                                                                                                                                                                              RT_ICON0x1c92c80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishUnited States0.3064516129032258
                                                                                                                                                                              RT_ICON0x1c95b00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishUnited States0.48986486486486486
                                                                                                                                                                              RT_DIALOG0x1c96d80x202dataEnglishUnited States0.4085603112840467
                                                                                                                                                                              RT_DIALOG0x1c98e00xf8dataEnglishUnited States0.6290322580645161
                                                                                                                                                                              RT_DIALOG0x1c99d80xeedataEnglishUnited States0.6260504201680672
                                                                                                                                                                              RT_DIALOG0x1c9ac80x1fadataEnglishUnited States0.40118577075098816
                                                                                                                                                                              RT_DIALOG0x1c9cc80xf0dataEnglishUnited States0.6666666666666666
                                                                                                                                                                              RT_DIALOG0x1c9db80xe6dataEnglishUnited States0.6565217391304348
                                                                                                                                                                              RT_DIALOG0x1c9ea00x1eedataEnglishUnited States0.38866396761133604
                                                                                                                                                                              RT_DIALOG0x1ca0900xe4dataEnglishUnited States0.6447368421052632
                                                                                                                                                                              RT_DIALOG0x1ca1780xdadataEnglishUnited States0.6422018348623854
                                                                                                                                                                              RT_DIALOG0x1ca2580x1eedataEnglishUnited States0.3866396761133603
                                                                                                                                                                              RT_DIALOG0x1ca4480xe4dataEnglishUnited States0.6359649122807017
                                                                                                                                                                              RT_DIALOG0x1ca5300xdadataEnglishUnited States0.6376146788990825
                                                                                                                                                                              RT_DIALOG0x1ca6100x1f2dataEnglishUnited States0.39759036144578314
                                                                                                                                                                              RT_DIALOG0x1ca8080xe8dataEnglishUnited States0.6508620689655172
                                                                                                                                                                              RT_DIALOG0x1ca8f00xdedataEnglishUnited States0.6486486486486487
                                                                                                                                                                              RT_DIALOG0x1ca9d00x202dataEnglishUnited States0.42217898832684825
                                                                                                                                                                              RT_DIALOG0x1cabd80xf8dataEnglishUnited States0.6653225806451613
                                                                                                                                                                              RT_DIALOG0x1cacd00xeedataEnglishUnited States0.6512605042016807
                                                                                                                                                                              RT_GROUP_ICON0x1cadc00x102dataEnglishUnited States0.627906976744186
                                                                                                                                                                              RT_VERSION0x1caec80x1e4dataEnglishUnited States0.49793388429752067
                                                                                                                                                                              RT_MANIFEST0x1cb0b00x423XML 1.0 document, ASCII text, with very long lines (1059), with no line terminatorsEnglishUnited States0.5127478753541076

                                                                                                                                                                              Imports

                                                                                                                                                                              DLLImport
                                                                                                                                                                              KERNEL32.dllSetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
                                                                                                                                                                              USER32.dllGetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
                                                                                                                                                                              GDI32.dllSelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                                                                                                                                              SHELL32.dllSHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
                                                                                                                                                                              ADVAPI32.dllAdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
                                                                                                                                                                              COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                                                                                                                                              ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                                                                                                                                              Possible Origin

                                                                                                                                                                              Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                              EnglishUnited States

                                                                                                                                                                              Network Behavior

                                                                                                                                                                              ⊘No network behavior found

                                                                                                                                                                              Statistics

                                                                                                                                                                              CPU Usage

                                                                                                                                                                              Click to jump to process

                                                                                                                                                                              Memory Usage

                                                                                                                                                                              Click to jump to process

                                                                                                                                                                              High Level Behavior Distribution

                                                                                                                                                                              Click to dive into process behavior distribution

                                                                                                                                                                              Behavior

                                                                                                                                                                              Click to jump to process

                                                                                                                                                                              System Behavior

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:0
                                                                                                                                                                              Start time:13:45:09
                                                                                                                                                                              Start date:14/11/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:"C:\Users\user\Desktop\cMqyGFCQHk.exe"
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:86'797'392 bytes
                                                                                                                                                                              MD5 hash:B408E3DA98F0E457D627510165374DDD
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:low
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:2
                                                                                                                                                                              Start time:13:45:11
                                                                                                                                                                              Start date:14/11/2024
                                                                                                                                                                              Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Teams.exe" /FO csv | "C:\Windows\system32\find.exe" "Teams.exe"
                                                                                                                                                                              Imagebase:0x1c0000
                                                                                                                                                                              File size:236'544 bytes
                                                                                                                                                                              MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:high
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:3
                                                                                                                                                                              Start time:13:45:11
                                                                                                                                                                              Start date:14/11/2024
                                                                                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                              Imagebase:0x7ff66e660000
                                                                                                                                                                              File size:862'208 bytes
                                                                                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:high
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:4
                                                                                                                                                                              Start time:13:45:11
                                                                                                                                                                              Start date:14/11/2024
                                                                                                                                                                              Path:C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Teams.exe" /FO csv
                                                                                                                                                                              Imagebase:0x2a0000
                                                                                                                                                                              File size:79'360 bytes
                                                                                                                                                                              MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:high
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:5
                                                                                                                                                                              Start time:13:45:11
                                                                                                                                                                              Start date:14/11/2024
                                                                                                                                                                              Path:C:\Windows\SysWOW64\find.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:"C:\Windows\system32\find.exe" "Teams.exe"
                                                                                                                                                                              Imagebase:0x870000
                                                                                                                                                                              File size:14'848 bytes
                                                                                                                                                                              MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:moderate
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:7
                                                                                                                                                                              Start time:13:45:40
                                                                                                                                                                              Start date:14/11/2024
                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Programs\Teams\Teams.exe"
                                                                                                                                                                              Imagebase:0x7ff7ef5e0000
                                                                                                                                                                              File size:188'819'968 bytes
                                                                                                                                                                              MD5 hash:102326801694C938E466C8D96E4200BD
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Antivirus matches:
                                                                                                                                                                              • Detection: 0%, ReversingLabs
                                                                                                                                                                              Reputation:low
                                                                                                                                                                              Has exited:false

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:11
                                                                                                                                                                              Start time:13:45:43
                                                                                                                                                                              Start date:14/11/2024
                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1708,i,13854425415668292357,6166449907864565243,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2
                                                                                                                                                                              Imagebase:0x7ff7ef5e0000
                                                                                                                                                                              File size:188'819'968 bytes
                                                                                                                                                                              MD5 hash:102326801694C938E466C8D96E4200BD
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:low
                                                                                                                                                                              Has exited:false

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:12
                                                                                                                                                                              Start time:13:45:42
                                                                                                                                                                              Start date:14/11/2024
                                                                                                                                                                              Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()""
                                                                                                                                                                              Imagebase:0x7ff72eb40000
                                                                                                                                                                              File size:289'792 bytes
                                                                                                                                                                              MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:high
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:13
                                                                                                                                                                              Start time:13:45:42
                                                                                                                                                                              Start date:14/11/2024
                                                                                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                              Imagebase:0x7ff66e660000
                                                                                                                                                                              File size:862'208 bytes
                                                                                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:high
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:14
                                                                                                                                                                              Start time:13:45:42
                                                                                                                                                                              Start date:14/11/2024
                                                                                                                                                                              Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"
                                                                                                                                                                              Imagebase:0x7ff6e3d50000
                                                                                                                                                                              File size:452'608 bytes
                                                                                                                                                                              MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:high
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:15
                                                                                                                                                                              Start time:13:45:46
                                                                                                                                                                              Start date:14/11/2024
                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2576,i,13854425415668292357,6166449907864565243,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:3
                                                                                                                                                                              Imagebase:0x7ff7ef5e0000
                                                                                                                                                                              File size:188'819'968 bytes
                                                                                                                                                                              MD5 hash:102326801694C938E466C8D96E4200BD
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:low
                                                                                                                                                                              Has exited:false

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:18
                                                                                                                                                                              Start time:13:45:58
                                                                                                                                                                              Start date:14/11/2024
                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Programs\Teams\Teams.exe"
                                                                                                                                                                              Imagebase:0x7ff7ef5e0000
                                                                                                                                                                              File size:188'819'968 bytes
                                                                                                                                                                              MD5 hash:102326801694C938E466C8D96E4200BD
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:low
                                                                                                                                                                              Has exited:false

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:19
                                                                                                                                                                              Start time:13:45:58
                                                                                                                                                                              Start date:14/11/2024
                                                                                                                                                                              Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()""
                                                                                                                                                                              Imagebase:0x7ff72eb40000
                                                                                                                                                                              File size:289'792 bytes
                                                                                                                                                                              MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:high
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:20
                                                                                                                                                                              Start time:13:45:59
                                                                                                                                                                              Start date:14/11/2024
                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1808,i,11489529828536578193,12839987917968536577,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2
                                                                                                                                                                              Imagebase:0x7ff7ef5e0000
                                                                                                                                                                              File size:188'819'968 bytes
                                                                                                                                                                              MD5 hash:102326801694C938E466C8D96E4200BD
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:low
                                                                                                                                                                              Has exited:false

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:21
                                                                                                                                                                              Start time:13:45:58
                                                                                                                                                                              Start date:14/11/2024
                                                                                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                              Imagebase:0x7ff66e660000
                                                                                                                                                                              File size:862'208 bytes
                                                                                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:22
                                                                                                                                                                              Start time:13:45:58
                                                                                                                                                                              Start date:14/11/2024
                                                                                                                                                                              Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"
                                                                                                                                                                              Imagebase:0x7ff6e3d50000
                                                                                                                                                                              File size:452'608 bytes
                                                                                                                                                                              MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:23
                                                                                                                                                                              Start time:13:46:01
                                                                                                                                                                              Start date:14/11/2024
                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2424,i,11489529828536578193,12839987917968536577,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
                                                                                                                                                                              Imagebase:0x7ff7ef5e0000
                                                                                                                                                                              File size:188'819'968 bytes
                                                                                                                                                                              MD5 hash:102326801694C938E466C8D96E4200BD
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:false

                                                                                                                                                                              Disassembly

                                                                                                                                                                              ⊘No disassembly