Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
kCKthbZCUf.exe

Overview

General Information

Sample name:kCKthbZCUf.exe
renamed because original name is a hash value
Original sample name:e4b06d32b35cf5d7c513abd7a5f440d48ff52fb73882366b4529b05653bb620c.exe
Analysis ID:1556255
MD5:e609504d8de12795520521d72727bfd9
SHA1:fe2e6f021f4bd6e0c3de23929273a0448c50982e
SHA256:e4b06d32b35cf5d7c513abd7a5f440d48ff52fb73882366b4529b05653bb620c
Tags:exeLionSoftwareLLCuser-JAMESWT_MHT
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Sigma detected: Powershell create lnk in startup
Drops large PE files
Powershell creates an autostart link
Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Drops PE files
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • kCKthbZCUf.exe (PID: 5756 cmdline: "C:\Users\user\Desktop\kCKthbZCUf.exe" MD5: E609504D8DE12795520521D72727BFD9)
    • cmd.exe (PID: 5892 cmdline: "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq FlowUs.exe" /FO csv | "C:\Windows\system32\find.exe" "FlowUs.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 5884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • tasklist.exe (PID: 7092 cmdline: tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq FlowUs.exe" /FO csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
      • find.exe (PID: 4760 cmdline: "C:\Windows\system32\find.exe" "FlowUs.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
  • FlowUs.exe (PID: 6580 cmdline: "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" MD5: 122EEE4C63DBC533BA58218E75C43098)
    • cmd.exe (PID: 2148 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 5844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 3840 cmdline: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • FlowUs.exe (PID: 5740 cmdline: "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1880,i,3782882238423362447,8962928300536026474,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2 MD5: 122EEE4C63DBC533BA58218E75C43098)
    • FlowUs.exe (PID: 2716 cmdline: "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --field-trial-handle=2428,i,3782882238423362447,8962928300536026474,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3 MD5: 122EEE4C63DBC533BA58218E75C43098)
    • FlowUs.exe (PID: 3424 cmdline: "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1184,i,3782882238423362447,8962928300536026474,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:8 MD5: 122EEE4C63DBC533BA58218E75C43098)
  • FlowUs.exe (PID: 5044 cmdline: "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" MD5: 122EEE4C63DBC533BA58218E75C43098)
    • FlowUs.exe (PID: 2684 cmdline: "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1752,i,11422593095879954725,17316753855438622449,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2 MD5: 122EEE4C63DBC533BA58218E75C43098)
    • cmd.exe (PID: 3504 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 1772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 2124 cmdline: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • FlowUs.exe (PID: 940 cmdline: "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --field-trial-handle=2420,i,11422593095879954725,17316753855438622449,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3 MD5: 122EEE4C63DBC533BA58218E75C43098)
    • FlowUs.exe (PID: 1288 cmdline: "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1188,i,11422593095879954725,17316753855438622449,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:8 MD5: 122EEE4C63DBC533BA58218E75C43098)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
Source: File createdAuthor: Christopher Peacock '@securepeacock', SCYTHE: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3840, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk
Sigma detected: Startup Folder File Write
Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3840, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()", CommandLine: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2148, ParentProcessName: cmd.exe, ProcessCommandLine: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()", ProcessId: 3840, ProcessName: powershell.exe

Persistence and Installation Behavior

barindex
Sigma detected: Powershell create lnk in startup
Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()"", CommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()"", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" , ParentImage: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe, ParentProcessId: 6580, ParentProcessName: FlowUs.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()"", ProcessId: 2148, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: kCKthbZCUf.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\kCKthbZCUf.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\a0a7857a-821b-5b40-9f43-4b1d27f2922eJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Programs\FlowUs\LICENSE.electron.txtJump to behavior
Source: kCKthbZCUf.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: ffmpeg.dll.pdb source: kCKthbZCUf.exe, 00000000.00000003.2372262920.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdb source: kCKthbZCUf.exe, 00000000.00000003.2367795392.0000000004F12000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\dev\test\x64\Release\test.pdb source: kCKthbZCUf.exe, 00000000.00000003.2429513453.0000000004D52000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vulkan-1.dll.pdb source: kCKthbZCUf.exe, 00000000.00000003.2358362657.0000000004F90000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2358133092.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363370706.0000000005B10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2423402426.0000000004D52000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\dev\test\Release\test.pdb source: kCKthbZCUf.exe, 00000000.00000003.2429760894.0000000004D52000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdbGCTL source: kCKthbZCUf.exe, 00000000.00000003.2367795392.0000000004F12000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: electron.exe.pdb source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: <C:\dev\test\x64\Release\test.pdb source: kCKthbZCUf.exe, 00000000.00000003.2429513453.0000000004D52000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdb source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vk_swiftshader.dll.pdb source: kCKthbZCUf.exe, 00000000.00000003.2423241071.0000000004F25000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile opened: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-listJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile opened: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpacked\node_modulesJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile opened: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpackedJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile opened: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendorJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile opened: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resourcesJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile opened: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\localesJump to behavior
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: * **Google Hangouts Video**: http://www.youtube.com/watch?v=I9nDOSGfwZg equals www.youtube.com (Youtube)
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.css
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.jpg
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://2x.io)
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096371
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096371expandIntegerPowExpressionsThe
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096454
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096539
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096608
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096608allowES3OnFL100Allow
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644593
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644627
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644627skipVSConstantRegisterZeroIn
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42260492
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42260591
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42260722
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261713
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261924
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261924allowClearForRobustResourceInitSome
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262386
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267045
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267082
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267082ProgramGL::postLinkJobImpl
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://blog.izs.me/)
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://certificates.godaddy.com/repository/gd_intermediate.crt0
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://certificates.godaddy.com/repository100.
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cldr.unicode.org/index/downloads
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/closure-compiler/wiki/SourceMaps
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/python-gflags/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/smhasher/
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/110263
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/308366
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/550292
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/565179
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/642227
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/644669
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/650547
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/672380
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/797243
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/809422
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/830046
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/883276
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/927470
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/941620
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.godaddy.com/gds1-20
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/common
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/commonnode-set..
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://feross.org
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://fresc81.github.io/node-winreg
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://git.linuxtv.org/v4l-utils.git
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/troygoode/)
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.github.io/snappy/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://html4/loose.dtd
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://icl.com/saxon
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://icl.com/saxonorg.apache.xalan.xslt.extensions.RedirectxsltDocumentElem:
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://n8.io/)
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ns.apple.com/HDRGainMap/1.0/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ns.apple.com/pixeldatainfo/1.0/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ns.google.com/photos/1.0/container/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ns.google.com/photos/1.0/container/item/
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.godaddy.com/0J
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://opensource.perlig.de/rjsmin/
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://s..
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://source.android.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://source.android.com/compatibility)
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/a/1068308/13216
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://substack.net
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://travis-ci.org/troygoode/node-require-directory)
Source: kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://website-archive.mozilla.org/www.mozilla.org/mpl/MPL/NPL/1.1/):
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://wpad/wpad.dat
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://wpad/wpad.dat..
Source: kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/
Source: kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/legal/guidelinesfor3rdparties.html.
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ecma-international.org/memento/codeofconduct.htm
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.finesse.demon.co.uk/steven/sqrt.html.
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.freedesktop.org/wiki/Software/xdg-user-dirs
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.futurealoof.com)
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gutenberg.org/ebooks/53).
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3C//DTD
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.jclark.com/xt
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.linux-usb.org/usb-ids.html
Source: kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/MPL/
Source: kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/NPL/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.apple.com/apsl/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/bsd-license.php
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pertinentdetail.org/sqrt
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ploscompbiol.org/static/license
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.polymer-project.org
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.portaudio.com
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.softsynth.com
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.unicode.org/copyright.html
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.webrtc.org
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/watch?v=I9nDOSGfwZg
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xmlsoft.org/XSLT/
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xmlsoft.org/XSLT/namespace
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xmlsoft.org/XSLT/namespacehttp://www.jclark.com/xtxsl:key
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xmlsoft.org/XSLT/xsltNewExtDef
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zlib.net/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://%s:%d/.well-known/masque/udp/%s/%d/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://%s:%d/.well-known/masque/udp/%s/%d/Net.QuicStreamFactory.DefaultNetworkMatchNet.QuicSession.
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://android.com/pay
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://android.googlesource.com/platform/external/puffin
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/upload
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/uploadhttps://beacons.gvt2.com/domainreliability/uplo
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons.gvt2.com/domainreliability/upload
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons2.gvt2.com/domainreliability/upload
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons3.gvt2.com/domainreliability/upload
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons4.gvt2.com/domainreliability/upload
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons5.gvt2.com/domainreliability/upload
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons5.gvt3.com/domainreliability/upload
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bit.ly/3rpDuEX.
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bit.ly/3rpDuEX.Invalid
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bit.ly/audio-worklet)
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bit.ly/audio-worklet)..
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.htmlMixed
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.android.clients.google.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.bigcache.googleapis.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.doc-0-0-sj.sj.googleusercontent.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.docs.google.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.drive.google.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.googlesyndication.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.pack.google.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.play.google.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://c.youtube.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2423855697.0000000004D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=ca&category=theme81https://myactivity.google.com/myactivity/?u
Source: kCKthbZCUf.exe, 00000000.00000003.2425784174.0000000004D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=he&category=theme81https://myactivity.google.com/myactivity/?u
Source: kCKthbZCUf.exe, 00000000.00000003.2426288911.0000000004D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=ko&category=theme81https://myactivity.google.com/myactivity/?u
Source: kCKthbZCUf.exe, 00000000.00000003.2426627588.0000000004D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=ms&category=theme81https://myactivity.google.com/myactivity/?u
Source: kCKthbZCUf.exe, 00000000.00000003.2429513453.0000000004D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u
Source: kCKthbZCUf.exe, 00000000.00000003.2426627588.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2426047384.0000000004D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: kCKthbZCUf.exe, 00000000.00000003.2426627588.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2426047384.0000000004D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: kCKthbZCUf.exe, 00000000.00000003.2426627588.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2426047384.0000000004D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: kCKthbZCUf.exe, 00000000.00000003.2426627588.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2426047384.0000000004D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: kCKthbZCUf.exe, 00000000.00000003.2426627588.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2426047384.0000000004D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: kCKthbZCUf.exe, 00000000.00000003.2426627588.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2426047384.0000000004D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromestatus.com/feature/5105856067141632.
Source: kCKthbZCUf.exe, 00000000.00000003.2426288911.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2423855697.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2427038035.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2427279607.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2424318493.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2425784174.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2425448765.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2424685872.0000000005F25000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2424081187.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2426047384.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2424507758.0000000005F25000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/external/github.com/intel/tinycbor.git
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/vulkan-deps/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/webm/libwebm
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/webm/libwebp
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/domainreliability/upload
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://code.google.com/p/v8/wiki/JavaScriptStackTraceApi
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1038223.
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1144908
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1144908.
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1144908.The
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1144908Changing
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1154140
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1429681
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/593024
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/593024selectViewInGeometryShaderThe
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000007006000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/619103.
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000007006000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/619103.Subsequence
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/650547
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/650547callClearTwiceUsing
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/655534
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/655534useSystemMemoryForConstantBuffersCopying
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/705865
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/710443
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/848952
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/927119
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/927119Blink.Script.SchedulingTypeScriptLoader
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/981419
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://creativecommons.org/licenses/by/3.0/
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling.
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.chrome.com/blog/enabling-shared-array-buffer/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.chrome.com/docs/extensions/mv3/cross-origin-isolation/.
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.chrome.com/docs/extensions/mv3/service_workers/events/
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.chrome.com/docs/extensions/mv3/service_workers/events/Script
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/includes
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/startsWith
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/android/guides/setup
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/d/17aTgLnjMXIrfjgNaTUnHQO7m3xgzHR2VXBTmi03Qii4/
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://domenic.me/)
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://example.org
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://example.orgExpired
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://feross.org
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://feross.org/opensource
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://feross.org/support
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gcp.gvt2.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gcp.gvt6.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Cyan4973/xxHash
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/GoogleChrome/web-vitals
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/GoogleChromeLabs/text-fragments-polyfill
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers.git
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools.git
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/Vulkan-Headers
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/Vulkan-Loader
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Maratyszcza/pthreadpool
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Nicoshev/rapidhash
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Nicoshev/rapidhash/blob/master/rapidhash.h
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/PortAudio/portaudio/tree/master/src/common
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ReactiveX/rxjs
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/RyanZim/universalify#readme
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/RyanZim/universalify.git
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/STRML/async-limiter
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Sebmaster/tr46.js#readme
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Sebmaster/tr46.js.git
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/SeleniumHQ/selenium/tree/trunk
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Squirrel/Squirrel.Mac
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/TooTallNate/util-deprecate
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/TroyGoode)
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.border-boxcontent-bo
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/scheduling-apis
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/shared-element-transitions/blob/main/debugging_overflow_on_images.md.
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/view-transitions/blob/main/debugging_overflow_on_images.md
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/WebAssembly/wasm-c-api/
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WebBluetoothCG/web-bluetooth/blob/main/implementation-status.md
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/aawc/unrar.git
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/brailcom/speechd
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/brycebaril/node-stream-meter.git
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/calvinmetcalf/process-nextick-args
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/calvinmetcalf/process-nextick-args.git
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/wrap-ansi?sponsor=1
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/conventional-changelog/standard-version):
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/dominictarr/rc.git
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/dpranke/typ.git
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/etingof/pyasn1
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/zstd
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/queue-microtask
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/run-parallel
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/safe-buffer
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/simple-concat
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/simple-get
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/fresc81/node-winreg
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/diff-match-patch/tree/master/javascript
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/distributed_point_functions
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/google-api-cpp-client/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/pprof/tree/master/proto
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/private-join-and-compute
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/protobuf
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/re2
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/ruy
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/securemessage
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/sentencepiece
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/shell-encryption
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/ukey2
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/wicked-good-xpath
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/woff2
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/wuffs-mirror-release-c
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/xnnpack
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/gpuweb/gpuweb/wiki/Implementation-Status#implementation-status
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/gpuweb/gpuweb/wiki/Implementation-Status#implementation-statusFailed
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-core-module
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-core-module.git
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/node-supports-preserve-symlinks-flag#readme
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/node-supports-preserve-symlinks-flag.git
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/intel/libva
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/101)
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/102)
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/105)
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/106
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/99)
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/labels/wg-agenda
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068737927
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068738228
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068738548
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068742592
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639071916
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639072106
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639072371
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639072571
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert)
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyent/node
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jprichardson/node-fs-extra
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jprichardson/node-fs-extra/issues/269
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jrmuizel/qcms/tree/v4
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/lgeiger/node-abi/issues/54
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/libuv/libuv/pull/1088
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb)
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/pump
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-fs
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-fs.git
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-stream
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-stream.git
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mcollina/reusify#readme
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mcollina/reusify.git
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/micromatch/to-regex-range
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mikeal/tunnel-agent
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/TSC/blob/master/Moderation-Policy.md
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/blob/master/CODE_OF_CONDUCT.md
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/blob/v10.8.0/lib/internal/errors.js
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/8871#issuecomment-250915913
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/8987
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/35407#issuecomment-700693439
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/string_decoder
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/normalize/mz
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/cli/blob/4c65cd952bc8627811735bea76b9b110cc4fc80e/lib/utils/ansi-trim.js
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-semver.git
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-tar/blob/51b6627a1f357d2eb433e7378e5f05e83b7aa6cd/lib/header.js#L349
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/wrappy
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/patrickhulce/third-party-web
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/prebuild/prebuild-install
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/prebuild/prebuild-install.git
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/protocolbuffers/protobuf-javascript
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/protocolbuffers/protobuf/blob/master/java/lite.md
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/puppeteer/puppeteer/tree/main/packages/puppeteer-core
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sass/node-sass/issues/1589#issuecomment-265292579
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/simplejson/simplejson
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/make-dir
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/os-homedir/blob/11e089f4754db38bb535e5a8416320c4446e8cfd/index.js
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/broofa
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/ctavan
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/feross
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/ljharb
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/models
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/tensorflow
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/text.git
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/tflite-support
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/test262-utils/test262-harness-py
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/troygoode/node-require-directory/
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/uuidjs/uuid.git
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/v8/v8/blob/6.0.122/test/mjsunit/fast-prototype.js#L48-L63
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068735040
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068735307
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068735697
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068736093
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068736404
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638965835
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638965968
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638966056
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638966247
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638966552
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615021
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615173
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615423
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615557
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615807
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/888438143
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/888438190
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/888438236
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/918633749
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/releases/download/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000007006000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/ServiceWorker/issues/1356.
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000007006000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/ServiceWorker/issues/1356.Property
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4805
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4805Custom
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/gamepad/pull/120
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/gamepad/pull/120Access
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-featuresDeviceOri
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/wasdk/wasmparser
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws.git
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws/issues/1202
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws/issues/1869.
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws/issues/1940.
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/xiph/rnnoise
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/y18n
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs#supported-nodejs-versions
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs-parser#supported-nodejs-versions
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs-parser.git
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs.git
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/zeux/volk
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/zorkow/speech-rule-engine
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gitlab.freedesktop.org/xorg/proto/xproto/
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/4NeimX
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/4NeimXAccess
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/4NeimXOrigin
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/4NeimXgetDescriptor(s)
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/4NeimXreadValue()
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/4NeimXwriteValue()
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/7K7WLu
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/7K7WLuThe
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/7K7WLuWebAudio.AutoplayWebAudio.Autoplay.CrossOriginWebAudio.Autoplay.UnlockType..
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/EuHzyv
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/HxfxSQ
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/HxfxSQOrigin
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/HxfxSQrequestDevice()
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/J6ASzs
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/J6ASzsBluetooth
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/LdLk22
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/LdLk22Media
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/LdLk22RemoveElementFromDocumentMapit
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/t5IS6M).
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/xX8pDD
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/xX8pDDplay()
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/ximf56
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/ximf56Iframe
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gle/chrome-insecure-origins
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google-analytics.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google.com/pay
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://googlevideo.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gvt1.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gvt2.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gvt6.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://hackerone.com/reports/541502
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hg.mozilla.org/mozilla-central/file/tip/netwerk/base/nsURLParsers.cpp
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/comms.html#the-websocket-interface
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://medium.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodei.co/npm/require-directory.png?downloads=true&stars=true)
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodei.co/npm/require-directory/)
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/api/fs.html#fs_stat_time_values)
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/dist
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000007006000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/en/docs/inspector
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000007006000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/en/docs/inspectorFor
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000007006000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/static/images/favicons/favicon.ico
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000007006000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/static/images/favicons/favicon.icofaviconUrldevtoolsFrontendUrldevtoolsFrontendUr
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://npmjs.org/package/require-directory))
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://opensource.apple.com/source/xnu/
Source: kCKthbZCUf.exe, 00000000.00000003.2423855697.0000000004D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://passwords.google.comCompte
Source: kCKthbZCUf.exe, 00000000.00000003.2426288911.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2426627588.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2426047384.0000000004D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://passwords.google.comGoogle
Source: kCKthbZCUf.exe, 00000000.00000003.2429513453.0000000004D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://passwords.google.comT
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pay.google.com/authentication
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://play.google.com/billing
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://play.google.com/billinghttps://google.com/payhttps://android.com/payhttps://pay.google.com/a
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://polymer-library.polymer-project.org
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/pyparsing
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/six/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.python.org/pypi/pyfakefs
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.python.org/pypi/webapp2
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://quiche.googlesource.com/quiche
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://redux.js.org/
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://secure.travis-ci.org/troygoode/node-require-directory.png)
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://semver.org/
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://shorturl.at/drFY7)
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sindresorhus.com
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sindresorhus.com)
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/site/gaviotachessengine/Home/endgame-tablebases-1
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sizzlejs.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://skia.org/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://source.chromium.org/chromium/chromium/src/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://source.corp.google.com/piper///depot/google3/third_party/tamachiyomi/README.md
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sourceforge.net/projects/wtl/files/WTL%2010/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sqlite.org/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ssl.gstatic.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2426288911.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2423855697.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2427038035.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2427279607.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2424318493.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2425784174.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2425448765.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2427626597.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2424081187.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2426047384.0000000004D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: kCKthbZCUf.exe, 00000000.00000003.2426288911.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2423855697.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2427038035.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2427279607.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2424318493.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2425784174.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2425448765.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2424685872.0000000005F25000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2427626597.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2424081187.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2426047384.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2424507758.0000000005F25000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swiftshader.googlesource.com/SwiftShader
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/security
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/security).
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc6455#section-9.1
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tukaani.org/xz/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tukaani.org/xz/&gt;.
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/intent/user?screen_name=troygoode)
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://unpkg.com/cliui
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://unpkg.com/yargs-parser
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#concept-url-origin
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#forbidden-host-code-point
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://v8.dev/
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/aria/#aria-hidden.
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/aria/#aria-hidden.Blocked
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/aria/#namefromprohibited.
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/manifest/#installability-signals
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/manifest/#installability-signals0
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/uievents/#legacy-event-types)
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webkit.org/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.bluetooth.com/specifications/gatt/characteristics
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.bluetooth.com/specifications/gatt/descriptors
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.bluetooth.com/specifications/gatt/services
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/4664843055398912
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5093566007214080
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5093566007214080ErrorEventInit
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5636954674692096
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5644273861001216.
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5682658461876224.
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5718547946799104
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5738264052891648
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5738264052891648Renderer.Font.PrimaryFont.FCPRenderer.Font.Prim
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/6662647093133312
Source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/6662647093133312InputDeviceCapabilities
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.chromium.org
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.cl.cam.ac.uk/%7Emgk25/ucs/utf8_check.c
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.khronos.org/registry/
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/wrap-ansi
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.opensource.org/licenses/bsd-license.php)
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.patreon.com/feross
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.unicode.org/copyright.html.
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://xhr.spec.whatwg.org/.
Source: kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yargs.js.org/
Source: kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://zod.dev
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000007006000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: RegisterRawInputDevices() failed for RIDEV_REMOVE memstr_612996c6-0

System Summary

barindex
Drops large PE files
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile dump: FlowUs.exe.0.dr 188699136Jump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile dump: FlowUs.exe0.0.dr 188699136Jump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeProcess token adjusted: SecurityJump to behavior
Source: kCKthbZCUf.exeStatic PE information: invalid certificate
Source: FlowUs.exe0.0.drStatic PE information: Number of sections : 15 > 10
Source: FlowUs.exe.0.drStatic PE information: Number of sections : 15 > 10
Source: kCKthbZCUf.exe, 00000000.00000003.2374331680.0000000005110000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename. vs kCKthbZCUf.exe
Source: kCKthbZCUf.exe, 00000000.00000003.2367795392.0000000004F12000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs kCKthbZCUf.exe
Source: kCKthbZCUf.exe, 00000000.00000003.2254754257.0000000006836000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs kCKthbZCUf.exe
Source: kCKthbZCUf.exe, 00000000.00000003.2429897161.0000000005F2C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameElevate.exeH vs kCKthbZCUf.exe
Source: kCKthbZCUf.exe, 00000000.00000003.2423241071.0000000004F25000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevk_swiftshader.dll, vs kCKthbZCUf.exe
Source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dllb! vs kCKthbZCUf.exe
Source: kCKthbZCUf.exe, 00000000.00000003.2429974960.0000000005F3A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameElevate.exeH vs kCKthbZCUf.exe
Source: kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevk_swiftshader.dll, vs kCKthbZCUf.exe
Source: kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dllb! vs kCKthbZCUf.exe
Source: kCKthbZCUf.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: mal60.spre.winEXE@32/103@0/0
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1772:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeMutant created: \Sessions\1\BaseNamedObjects\mfx_d3d_mutex
Source: C:\Users\user\Desktop\kCKthbZCUf.exeMutant created: \Sessions\1\BaseNamedObjects\a0a7857a-821b-5b40-9f43-4b1d27f2922e
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5884:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5844:120:WilError_03
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsj37C5.tmpJump to behavior
Source: kCKthbZCUf.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = &apos;FLOWUS.EXE&apos;
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT name FROM sqlite_master WHERE type='table';
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile read: C:\Users\user\Desktop\kCKthbZCUf.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\kCKthbZCUf.exe "C:\Users\user\Desktop\kCKthbZCUf.exe"
Source: C:\Users\user\Desktop\kCKthbZCUf.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq FlowUs.exe" /FO csv | "C:\Windows\system32\find.exe" "FlowUs.exe"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq FlowUs.exe" /FO csv
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe "C:\Windows\system32\find.exe" "FlowUs.exe"
Source: unknownProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe"
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()""
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1880,i,3782882238423362447,8962928300536026474,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()"
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --field-trial-handle=2428,i,3782882238423362447,8962928300536026474,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
Source: unknownProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe"
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1752,i,11422593095879954725,17316753855438622449,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()"
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --field-trial-handle=2420,i,11422593095879954725,17316753855438622449,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1184,i,3782882238423362447,8962928300536026474,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1188,i,11422593095879954725,17316753855438622449,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:8
Source: C:\Users\user\Desktop\kCKthbZCUf.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq FlowUs.exe" /FO csv | "C:\Windows\system32\find.exe" "FlowUs.exe"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq FlowUs.exe" /FO csv Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe "C:\Windows\system32\find.exe" "FlowUs.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1880,i,3782882238423362447,8962928300536026474,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --field-trial-handle=2428,i,3782882238423362447,8962928300536026474,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1184,i,3782882238423362447,8962928300536026474,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:8Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1752,i,11422593095879954725,17316753855438622449,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --field-trial-handle=2420,i,11422593095879954725,17316753855438622449,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1188,i,11422593095879954725,17316753855438622449,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:8Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()"
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: iconcodecservice.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dllJump to behavior
Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mmdevapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: devobj.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mscms.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: coloradapterclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: duser.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: xmllite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: atlthunk.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mf.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mfplat.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: rtworkq.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mmdevapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: devobj.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mscms.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: coloradapterclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mf.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mfplat.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: rtworkq.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mpr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: scrrun.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: d3d12core.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dxilconv.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: d3dscache.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: directml.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: d3d12core.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: dxilconv.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: d3dscache.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: directml.dll
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeSection loaded: cabinet.dll
Source: C:\Users\user\Desktop\kCKthbZCUf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq FlowUs.exe" /FO csv
Source: MyElectronApp.lnk.14.drLNK file: ..\..\..\..\..\..\Local\Programs\FlowUs\FlowUs.exe
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\a0a7857a-821b-5b40-9f43-4b1d27f2922eJump to behavior
Source: kCKthbZCUf.exeStatic file information: File size 86624960 > 1048576
Source: kCKthbZCUf.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: ffmpeg.dll.pdb source: kCKthbZCUf.exe, 00000000.00000003.2372262920.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdb source: kCKthbZCUf.exe, 00000000.00000003.2367795392.0000000004F12000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\dev\test\x64\Release\test.pdb source: kCKthbZCUf.exe, 00000000.00000003.2429513453.0000000004D52000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vulkan-1.dll.pdb source: kCKthbZCUf.exe, 00000000.00000003.2358362657.0000000004F90000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2358133092.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363370706.0000000005B10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2423402426.0000000004D52000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\dev\test\Release\test.pdb source: kCKthbZCUf.exe, 00000000.00000003.2429760894.0000000004D52000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdbGCTL source: kCKthbZCUf.exe, 00000000.00000003.2367795392.0000000004F12000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: electron.exe.pdb source: kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: <C:\dev\test\x64\Release\test.pdb source: kCKthbZCUf.exe, 00000000.00000003.2429513453.0000000004D52000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdb source: kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vk_swiftshader.dll.pdb source: kCKthbZCUf.exe, 00000000.00000003.2423241071.0000000004F25000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmp
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .retplne
Source: vk_swiftshader.dll.0.drStatic PE information: section name: _RDATA
Source: vulkan-1.dll.0.drStatic PE information: section name: .gxfg
Source: vulkan-1.dll.0.drStatic PE information: section name: .retplne
Source: vulkan-1.dll.0.drStatic PE information: section name: _RDATA
Source: ffmpeg.dll.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll.0.drStatic PE information: section name: _RDATA
Source: FlowUs.exe.0.drStatic PE information: section name: .gxfg
Source: FlowUs.exe.0.drStatic PE information: section name: .retplne
Source: FlowUs.exe.0.drStatic PE information: section name: .rodata
Source: FlowUs.exe.0.drStatic PE information: section name: CPADinfo
Source: FlowUs.exe.0.drStatic PE information: section name: LZMADEC
Source: FlowUs.exe.0.drStatic PE information: section name: _RDATA
Source: FlowUs.exe.0.drStatic PE information: section name: malloc_h
Source: FlowUs.exe.0.drStatic PE information: section name: prot
Source: ffmpeg.dll0.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll0.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll0.0.drStatic PE information: section name: _RDATA
Source: FlowUs.exe0.0.drStatic PE information: section name: .gxfg
Source: FlowUs.exe0.0.drStatic PE information: section name: .retplne
Source: FlowUs.exe0.0.drStatic PE information: section name: .rodata
Source: FlowUs.exe0.0.drStatic PE information: section name: CPADinfo
Source: FlowUs.exe0.0.drStatic PE information: section name: LZMADEC
Source: FlowUs.exe0.0.drStatic PE information: section name: _RDATA
Source: FlowUs.exe0.0.drStatic PE information: section name: malloc_h
Source: FlowUs.exe0.0.drStatic PE information: section name: prot
Source: libEGL.dll.0.drStatic PE information: section name: .gxfg
Source: libEGL.dll.0.drStatic PE information: section name: .retplne
Source: libEGL.dll.0.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll.0.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll.0.drStatic PE information: section name: .retplne
Source: libGLESv2.dll.0.drStatic PE information: section name: _RDATA
Source: fastlist-0.3.0-x64.exe.0.drStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Programs\FlowUs\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\SpiderBanner.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\FlowUs.exeJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exeJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exeJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Programs\FlowUs\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\nsExec.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile created: C:\Users\user\AppData\Local\Programs\FlowUs\LICENSE.electron.txtJump to behavior

Boot Survival

barindex
Powershell creates an autostart link
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: .lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell engine required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module via navigations and search. Tags = @('powershell','unit testing','bdd','tdd','mocking') # The web address of an icon which can be
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: .lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell engine required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module via navigations and search. Tags = @('powershell','unit testing','bdd','tdd','mocking') # The web address of an icon which can be
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnkJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnkJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4258Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1626Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3580
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 626
Source: C:\Users\user\Desktop\kCKthbZCUf.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\FlowUs\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\SpiderBanner.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exeJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exeJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\nsExec.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\kCKthbZCUf.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\System.dllJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 344Thread sleep count: 4258 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 344Thread sleep count: 1626 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6308Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6160Thread sleep time: -1844674407370954s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2460Thread sleep count: 3580 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2460Thread sleep count: 626 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1968Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6588Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeFile Volume queried: C:\Users\user\AppData\Local\Programs\FlowUs FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeFile Volume queried: C:\Users\user\AppData\Local\Programs\FlowUs FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeFile Volume queried: C:\Users\user\AppData\Local\Programs\FlowUs FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeFile Volume queried: C:\Users\user\AppData\Local\Programs\FlowUs FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeFile Volume queried: C:\Users\user FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile opened: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-listJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile opened: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpacked\node_modulesJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile opened: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpackedJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile opened: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendorJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile opened: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resourcesJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeFile opened: C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\localesJump to behavior
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: bCK1sK9IRQq9qEmUv4RDsNuESgMjGWdqb8FuvAY5N9GIIvejQjBAMA8GA1UdEwEB/wQFMAMB
Source: kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMware
Source: kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: (IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSDKVersion() < 27 && IsAdreno5xxOrOlder(functions)) || (!isMesa && IsMaliT8xxOrOlder(functions)) || (!isMesa && IsMaliG31OrOlder(functions))
Source: kCKthbZCUf.exe, 00000000.00000003.2372262920.0000000004F1E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tgaR
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: kCKthbZCUf.exe, 00000000.00000003.2372262920.0000000004F1E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Screen Codec / VMware Video
Source: kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ZAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTestp
Source: C:\Users\user\Desktop\kCKthbZCUf.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\kCKthbZCUf.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq FlowUs.exe" /FO csv | "C:\Windows\system32\find.exe" "FlowUs.exe"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq FlowUs.exe" /FO csv Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe "C:\Windows\system32\find.exe" "FlowUs.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1880,i,3782882238423362447,8962928300536026474,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --field-trial-handle=2428,i,3782882238423362447,8962928300536026474,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1184,i,3782882238423362447,8962928300536026474,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:8Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1752,i,11422593095879954725,17316753855438622449,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --field-trial-handle=2420,i,11422593095879954725,17316753855438622449,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1188,i,11422593095879954725,17316753855438622449,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:8Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()"
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\flowus\flowus.exe';$s.save()""
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "c:\users\user\appdata\local\programs\flowus\flowus.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\flowus" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1880,i,3782882238423362447,8962928300536026474,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "c:\users\user\appdata\local\programs\flowus\flowus.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\flowus" --field-trial-handle=2428,i,3782882238423362447,8962928300536026474,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "c:\users\user\appdata\local\programs\flowus\flowus.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\flowus" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1752,i,11422593095879954725,17316753855438622449,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\flowus\flowus.exe';$s.save()""
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "c:\users\user\appdata\local\programs\flowus\flowus.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\flowus" --field-trial-handle=2420,i,11422593095879954725,17316753855438622449,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "c:\users\user\appdata\local\programs\flowus\flowus.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\flowus" --gpu-preferences=uaaaaaaaaadoaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaabcaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1184,i,3782882238423362447,8962928300536026474,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "c:\users\user\appdata\local\programs\flowus\flowus.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\flowus" --gpu-preferences=uaaaaaaaaadoaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaabcaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1188,i,11422593095879954725,17316753855438622449,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\flowus\flowus.exe';$s.save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "c:\users\user\appdata\local\programs\flowus\flowus.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\flowus" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1880,i,3782882238423362447,8962928300536026474,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "c:\users\user\appdata\local\programs\flowus\flowus.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\flowus" --field-trial-handle=2428,i,3782882238423362447,8962928300536026474,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "c:\users\user\appdata\local\programs\flowus\flowus.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\flowus" --gpu-preferences=uaaaaaaaaadoaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaabcaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1184,i,3782882238423362447,8962928300536026474,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "c:\users\user\appdata\local\programs\flowus\flowus.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\flowus" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1752,i,11422593095879954725,17316753855438622449,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\flowus\flowus.exe';$s.save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "c:\users\user\appdata\local\programs\flowus\flowus.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\flowus" --field-trial-handle=2420,i,11422593095879954725,17316753855438622449,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeProcess created: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe "c:\users\user\appdata\local\programs\flowus\flowus.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\flowus" --gpu-preferences=uaaaaaaaaadoaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaabcaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1188,i,11422593095879954725,17316753855438622449,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:8Jump to behavior
Source: kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ..\..\third_party\webrtc\modules\desktop_capture\win\window_capture_utils.ccFail to create instance of VirtualDesktopManagerChrome_WidgetWin_Progman..\..\third_party\webrtc\modules\desktop_capture\cropping_window_capturer.ccWindow no longer on top when ScreenCapturer finishesScreenCapturer failed to capture a frameWindow rect is emptyWindow is outside of the captured displaySysShadowWebRTC.DesktopCapture.Win.WindowGdiCapturerFrameTime..\..\third_party\webrtc\modules\desktop_capture\win\window_capturer_win_gdi.ccWindow hasn't been selected: Target window has been closed.Failed to get drawable window area: Failed to get window DC: Failed to create frame.Both PrintWindow() and BitBlt() failed.Capturing owned window failed (previous error/warning pertained to that)WindowCapturerWinGdi::CaptureFrameWebRTC.DesktopCapture.BlankFrameDetectedWebRTC.DesktopCapture.PrimaryCapturerSelectSourceErrorWebRTC.DesktopCapture.PrimaryCapturerErrorWebRTC.DesktopCapture.PrimaryCapturerPermanentErrordwmapi.dllDwmEnableComposition..\..\third_party\webrtc\modules\desktop_capture\win\screen_capturer_win_gdi.ccFailed to capture screen by GDI.WebRTC.DesktopCapture.Win.ScreenGdiCapturerFrameTimedesktop_dc_memory_dc_Failed to get screen rect.Failed to create frame buffer.Failed to select current bitmap into memery dc.BitBlt failedScreenCapturerWinGdi::CaptureFrame..\..\third_party\webrtc\modules\desktop_capture\win\cursor.ccwebrtc::CreateMouseCursorFromHCursorUnable to get cursor icon info. Error = Unable to get bitmap info. Error = Unable to get bitmap bits. Error = `
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\Users VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\Users\user VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\Users\user\AppData\Local VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\Users\user\AppData\Local\Programs VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\Users\user\AppData\Local\Programs\FlowUs VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\Users\user\AppData\Local\Programs\FlowUs\resources\app.asar VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\Users VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\Users\user\AppData\Local VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\Users\user\AppData\Roaming\FlowUs\Local State VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\Users\user\AppData\Roaming\FlowUs\config.json VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\Users\user\AppData\Roaming\FlowUs\config.json VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Windows Management Instrumentation		1
Windows Service		1
Windows Service		1
Masquerading		11
Input Capture		1
Security Software Discovery		Remote Services11
Input Capture		Data ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Command and Scripting Interpreter		12
Registry Run Keys / Startup Folder		12
Process Injection		21
Virtualization/Sandbox Evasion		LSASS Memory3
Process Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
PowerShell		1
DLL Side-Loading		12
Registry Run Keys / Startup Folder		12
Process Injection		Security Account Manager21
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
DLL Side-Loading		1
DLL Side-Loading		NTDS1
Application Window Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets1
Remote System Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials2
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync34
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1556255 Sample: kCKthbZCUf.exe Startdate: 15/11/2024 Architecture: WINDOWS Score: 60 59 Sigma detected: Powershell create lnk in startup 2->59 61 Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE 2->61 7 kCKthbZCUf.exe 11 226 2->7         started        11 FlowUs.exe 4 2->11         started        13 FlowUs.exe 1 2->13         started        process3 file4 49 C:\Users\user\AppData\Local\...\FlowUs.exe, PE32+ 7->49 dropped 51 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 7->51 dropped 53 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 7->53 dropped 55 15 other files (none is malicious) 7->55 dropped 63 Drops large PE files 7->63 15 cmd.exe 1 7->15         started        17 cmd.exe 1 11->17         started        19 FlowUs.exe 1 11->19         started        21 FlowUs.exe 1 11->21         started        23 FlowUs.exe 11->23         started        25 cmd.exe 13->25         started        27 FlowUs.exe 1 13->27         started        29 FlowUs.exe 1 13->29         started        31 FlowUs.exe 13->31         started        signatures5 process6 process7 33 conhost.exe 15->33         started        35 tasklist.exe 1 15->35         started        37 find.exe 1 15->37         started        39 powershell.exe 17 17->39         started        43 conhost.exe 17->43         started        45 conhost.exe 25->45         started        47 powershell.exe 25->47         started        file8 57 C:\Users\user\AppData\...\MyElectronApp.lnk, MS 39->57 dropped 65 Powershell creates an autostart link 39->65 signatures9

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
kCKthbZCUf.exe0%ReversingLabs
kCKthbZCUf.exe1%VirustotalBrowse

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe0%ReversingLabs
C:\Users\user\AppData\Local\Programs\FlowUs\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\FlowUs\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\FlowUs.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\elevate.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\vulkan-1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu393D.tmp\SpiderBanner.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu393D.tmp\StdUtils.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu393D.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu393D.tmp\nsExec.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu393D.tmp\nsis7z.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://secure.travis-ci.org/troygoode/node-require-directory.png)0%Avira URL Cloudsafe
https://w3c.github.io/aria/#namefromprohibited.0%Avira URL Cloudsafe
https://yargs.js.org/0%Avira URL Cloudsafe
https://tukaani.org/xz/&gt;.0%Avira URL Cloudsafe
https://nodei.co/npm/require-directory/)0%Avira URL Cloudsafe
http://fresc81.github.io/node-winreg0%Avira URL Cloudsafe
https://secure.travis-ci.org/troygoode/node-require-directory.png)0%VirustotalBrowse
https://yargs.js.org/0%VirustotalBrowse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://github.com/lgeiger/node-abi/issues/54kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
    		high
    https://github.com/mcollina/reusify#readmekCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
      		high
      https://url.spec.whatwg.org/#concept-url-originkCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
        		high
        https://github.com/gpuweb/gpuweb/wiki/Implementation-Status#implementation-statuskCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpfalse
          		high
          https://github.com/simplejson/simplejsonkCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            https://support.google.com/chrome/answer/6098869kCKthbZCUf.exe, 00000000.00000003.2426288911.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2423855697.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2427038035.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2427279607.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2424318493.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2425784174.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2425448765.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2424685872.0000000005F25000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2427626597.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2424081187.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2426047384.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2424507758.0000000005F25000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              https://chrome.google.com/webstore?hl=ms&category=theme81https://myactivity.google.com/myactivity/?ukCKthbZCUf.exe, 00000000.00000003.2426627588.0000000004D52000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                https://www.bluetooth.com/specifications/gatt/serviceskCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpfalse
                  		high
                  https://github.com/prebuild/prebuild-installkCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                    		high
                    https://github.com/vercel/pkg-fetch/actions/runs/2638965835kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                      		high
                      https://github.com/WebBluetoothCG/web-bluetooth/blob/main/implementation-status.mdkCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        https://github.com/jesec/pkg-fetch/actions/runs/2639072106kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          https://github.com/feross/queue-microtaskkCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            https://www.chromestatus.com/feature/5093566007214080kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              https://github.com/nodejs/string_decoderkCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                		high
                                https://goo.gl/7K7WLuThekCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high
                                  https://docs.google.com/kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpfalse
                                    		high
                                    https://secure.travis-ci.org/troygoode/node-require-directory.png)kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                    • 0%, Virustotal, Browse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://goo.gl/7K7WLukCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3C//DTDkCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpfalse
                                        		high
                                        https://www.patreon.com/ferosskCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		high
                                          https://goo.gl/t5IS6M).kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		high
                                            http://crbug.com/110263kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              https://github.com/vercel/pkg-fetch/actions/runs/2638965968kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://yargs.js.org/kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                • 0%, Virustotal, Browse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://semver.org/kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://github.com/google/pprof/tree/master/protokCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://github.com/jrmuizel/qcms/tree/v4kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://npmjs.org/package/require-directory))kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://chromium.googlesource.com/chromium/src/kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://w3c.github.io/aria/#namefromprohibited.kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://bit.ly/3rpDuEX.kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://crbug.com/593024kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://w3c.github.io/manifest/#installability-signalskCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://exslt.org/commonkCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://github.com/tensorflow/modelskCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://c.docs.google.com/kCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://github.com/KhronosGroup/SPIRV-Headers.gitkCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://github.com/w3c/ServiceWorker/issues/1356.PropertykCKthbZCUf.exe, 00000000.00000003.2364232568.0000000007006000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://nodei.co/npm/require-directory/)kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          https://crbug.com/710443kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWithkCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://github.com/tensorflow/tflite-supportkCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://github.com/WICG/scheduling-apiskCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://pypi.org/project/pyparsingkCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://sqlite.org/kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://code.google.com/p/v8/wiki/JavaScriptStackTraceApikCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://code.google.com/p/chromium/issues/detail?id=25916kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://www.opensource.org/licenses/mit-license.php)kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://stackoverflow.com/a/1068308/13216kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://github.com/jesec/pkg-fetch/actions/runs/2639072371kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://twitter.com/intent/user?screen_name=troygoode)kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://anglebug.com/40096454kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://github.com/gpuweb/gpuweb/wiki/Implementation-Status#implementation-statusFailedkCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://github.com/libuv/libuv/pull/1088kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://tukaani.org/xz/&gt;.kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown
                                                                                                        http://fresc81.github.io/node-winregkCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown
                                                                                                        https://developer.chrome.com/docs/extensions/mv3/service_workers/events/ScriptkCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://sizzlejs.com/kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://crbug.com/650547callClearTwiceUsingkCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://medium.com/kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://html4/loose.dtdkCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://www.portaudio.comkCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://www.unicode.org/copyright.htmlkCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://beacons.gcp.gvt2.com/domainreliability/uploadkCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://github.com/inspect-js/node-supports-preserve-symlinks-flag.gitkCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://github.com/vercel/pkg-fetch/actions/runs/2068735040kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://github.com/vercel/pkg-fetch/actions/runs/752615557kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://github.com/RyanZim/universalify.gitkCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://w3c.github.io/aria/#aria-hidden.kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://developer.chrome.com/docs/extensions/mv3/cross-origin-isolation/.kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://github.com/google/shell-encryptionkCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://github.com/wasdk/wasmparserkCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://passwords.google.comComptekCKthbZCUf.exe, 00000000.00000003.2423855697.0000000004D52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://unpkg.com/cliuikCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://goo.gl/4NeimXOriginkCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://github.com/dpranke/typ.gitkCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://github.com/nodejs/node/issues/8987kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://github.com/vercel/pkg-fetch/actions/runs/752615423kCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://chromeenterprise.google/policies/#BrowserSwitcherUrlListkCKthbZCUf.exe, 00000000.00000003.2426627588.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2426047384.0000000004D52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setintervalkCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          http://anglebug.com/42261924allowClearForRobustResourceInitSomekCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://www.khronos.org/registry/kCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://github.com/sponsors/ferosskCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://.jpgkCKthbZCUf.exe, 00000000.00000003.2364232568.00000000070A8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://android.com/paykCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://nodejs.org/static/images/favicons/favicon.icofaviconUrldevtoolsFrontendUrldevtoolsFrontendUrkCKthbZCUf.exe, 00000000.00000003.2364232568.0000000007006000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://nodejs.org/en/docs/inspectorForkCKthbZCUf.exe, 00000000.00000003.2364232568.0000000007006000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://passwords.google.comTkCKthbZCUf.exe, 00000000.00000003.2429513453.0000000004D52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://xhr.spec.whatwg.org/.kCKthbZCUf.exe, 00000000.00000003.2364232568.0000000006D50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://www.chromestatus.com/feature/6662647093133312kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://sindresorhus.comkCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                http://crbug.com/830046kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://crbug.com/1144908kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling.kCKthbZCUf.exe, 00000000.00000003.2364744897.0000000007293000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      http://anglebug.com/42262386kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://pypi.python.org/pypi/pyfakefskCKthbZCUf.exe, 00000000.00000003.2239350011.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2422635687.0000000005114000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://github.com/mafintosh/tar-stream.gitkCKthbZCUf.exe, 00000000.00000003.2250182632.0000000005910000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            http://crbug.com/672380kCKthbZCUf.exe, 00000000.00000003.2422345419.000000000511A000.00000004.00000020.00020000.00000000.sdmp, kCKthbZCUf.exe, 00000000.00000003.2363897809.0000000006810000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high

                                                                                                                                                                                              World Map of Contacted IPs

                                                                                                                                                                                              ⊘No contacted IP infos

                                                                                                                                                                                              General Information

                                                                                                                                                                                              Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                              Analysis ID:1556255
                                                                                                                                                                                              Start date and time:2024-11-15 08:21:36 +01:00
                                                                                                                                                                                              Joe Sandbox product:CloudBasic
                                                                                                                                                                                              Overall analysis duration:0h 9m 40s
                                                                                                                                                                                              Hypervisor based Inspection enabled:false
                                                                                                                                                                                              Report type:full
                                                                                                                                                                                              Cookbook file name:default.jbs
                                                                                                                                                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                              Run name:Run with higher sleep bypass
                                                                                                                                                                                              Number of analysed new started processes analysed:24
                                                                                                                                                                                              Number of new started drivers analysed:0
                                                                                                                                                                                              Number of existing processes analysed:0
                                                                                                                                                                                              Number of existing drivers analysed:0
                                                                                                                                                                                              Number of injected processes analysed:0
                                                                                                                                                                                              Technologies:
                                                                                                                                                                                              • HCA enabled
                                                                                                                                                                                              • EGA enabled
                                                                                                                                                                                              • AMSI enabled
                                                                                                                                                                                              Analysis Mode:default
                                                                                                                                                                                              Analysis stop reason:Timeout
                                                                                                                                                                                              Sample name:kCKthbZCUf.exe
                                                                                                                                                                                              renamed because original name is a hash value
                                                                                                                                                                                              Original Sample Name:e4b06d32b35cf5d7c513abd7a5f440d48ff52fb73882366b4529b05653bb620c.exe
                                                                                                                                                                                              Detection:MAL
                                                                                                                                                                                              Classification:mal60.spre.winEXE@32/103@0/0
                                                                                                                                                                                              EGA Information:Failed
                                                                                                                                                                                              HCA Information:
                                                                                                                                                                                              • Successful, ratio: 100%
                                                                                                                                                                                              • Number of executed functions: 0
                                                                                                                                                                                              • Number of non-executed functions: 0
                                                                                                                                                                                              Cookbook Comments:
                                                                                                                                                                                              • Found application associated with file extension: .exe
                                                                                                                                                                                              • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                                                                                                                                                              • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

                                                                                                                                                                                              Warnings

                                                                                                                                                                                              • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                                                                                                                                                                              • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                              • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                              • Report size getting too big, too many NtQueryVolumeInformationFile calls found.

                                                                                                                                                                                              Simulations

                                                                                                                                                                                              Behavior and APIs

                                                                                                                                                                                              TimeTypeDescription
                                                                                                                                                                                              08:23:17AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk

                                                                                                                                                                                              Joe Sandbox View / Context

                                                                                                                                                                                              IPs

                                                                                                                                                                                              ⊘No context

                                                                                                                                                                                              Domains

                                                                                                                                                                                              ⊘No context

                                                                                                                                                                                              ASNs

                                                                                                                                                                                              ⊘No context

                                                                                                                                                                                              JA3 Fingerprints

                                                                                                                                                                                              ⊘No context

                                                                                                                                                                                              Dropped Files

                                                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\FlowUs\d3dcompiler_47.dllG4fDWS1Fpd.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                a2zZyepQzF.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                  cMqyGFCQHk.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    cMqyGFCQHk.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      Soltix.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        Soltix.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          Prismifyr_Installer_v2.1 Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            Prismifyr_Installer_v2.1 Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                              Prismifyr_Installer_v2.1 Setup 1.0.0.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                Created / dropped Files

                                                                                                                                                                                                                C:\Users\user\AppData\Local\D3DSCache\2e4e93ba6dd06414\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):65552
                                                                                                                                                                                                                Entropy (8bit):0.012618579311362982
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:eIllGlll/l/lXp9ZjrPBY0HlGltFlrP:eIl0dPBY0oz
                                                                                                                                                                                                                MD5:52F654E734827BD46FF421599A391822
                                                                                                                                                                                                                SHA1:BD0C4798CB2FD7E51F9FC1765DF545E27FCE6A33
                                                                                                                                                                                                                SHA-256:3B684549A61505FED55855A3697A2BE354181248414EA0E8641CEFE7B4F8A9D9
                                                                                                                                                                                                                SHA-512:C6C6828DE5E6B16B1A1D80048FE8DB5AB226D9DEE1F802B98838CE8B07EB8D5644BF1A90D5B507A071ED025A18AE224044D52A8F767BAF65C7C16B5DCD0A3136
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:r~.j........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\D3DSCache\2e4e93ba6dd06414\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe
                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                Size (bytes):4
                                                                                                                                                                                                                Entropy (8bit):1.5
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:R:R
                                                                                                                                                                                                                MD5:F49655F856ACB8884CC0ACE29216F511
                                                                                                                                                                                                                SHA1:CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
                                                                                                                                                                                                                SHA-256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
                                                                                                                                                                                                                SHA-512:599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:EERF

                                                                                                                                                                                                                C:\Users\user\AppData\Local\D3DSCache\2e4e93ba6dd06414\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe
                                                                                                                                                                                                                File Type:Matlab v4 mat-file (little endian) (, numeric, rows 0, columns 16, imaginary
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):65536
                                                                                                                                                                                                                Entropy (8bit):0.02618799738687654
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6:g9q0c5ZsUEZ+lX1IbR63lWls3lWl7tr2Hrn:R6Q1IbY3lWls3lWlV2L
                                                                                                                                                                                                                MD5:994072846F4F5E1B2F05CE547BBA0C25
                                                                                                                                                                                                                SHA1:D98A3F410971933C0ECC1161E4C20F79D748BF1E
                                                                                                                                                                                                                SHA-256:165EE0BF591B3880A4DD8F591212738947DC736F8EFFE67CD3E6A61CE4589507
                                                                                                                                                                                                                SHA-512:0592FB9C1A34AA53B05CA4E03AF3D711E9D8F23CB18FD10CA778D86D37F3C8F27FFBA6BEFF64BAB8004B304B89A839026908272C8CEC03B67E2C738D9A2D3A64
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:................r...(....x:no.&A.e.u~+..C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.F.l.o.w.U.s.\.F.l.o.w.U.s...e.x.e.............................(...p.DJ!.IL.....Zm.F............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):64
                                                                                                                                                                                                                Entropy (8bit):0.34726597513537405
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:Nlll:Nll
                                                                                                                                                                                                                MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                                                                                                                                                                SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                                                                                                                                                                SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                                                                                                                                                                SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:@...e...........................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):188699136
                                                                                                                                                                                                                Entropy (8bit):6.758231694605685
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:1572864:Zwl41lgY+w9QLv1JWYc6UeOtUUGQUT1jdu4BPPuuwT2GOqiB1sr7zjg7ob753oUV:/F4oD0QdG09P
                                                                                                                                                                                                                MD5:122EEE4C63DBC533BA58218E75C43098
                                                                                                                                                                                                                SHA1:0F78646245DBCAD2F1E3737E6B19589F4897D341
                                                                                                                                                                                                                SHA-256:E21A75F17719AF6E2920AC0CC2E638CD22906DF3666B4A792C80A75DB2F7D447
                                                                                                                                                                                                                SHA-512:5B8C688594F1FE89359083563F184A8BEE63BD6EB915FECC42A4847DDB25A196FF13DE9A74F3D505614E403EAA492BF458F40B5CA7A515CB3D433CCEFDE2EAB5
                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."......FH.........`IY........@.............................`~...........`..........................................d..k...0...h....`m......#...H.......... o..5..P.......................0...(....}H.@............................................text...*DH......FH................. ..`.rdata.......`H......LH.............@..@.data....H......L..................@....pdata....H...#...H.................@..@.gxfg....B...pl..D....-.............@..@.retplne......l......*...................rodata.......l......,.............. ..`.tls..........l......>..............@...CPADinfo8.....m......D..............@...LZMADEC.......m......F.............. ..`_RDATA.......0m......X..............@..@malloc_h.....@m......Z.............. ..`prot.........Pm......\..............@..@.rsrc.......`m......^..............@..@.reloc...5... o..6....0.............@..B................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Programs\FlowUs\chrome_100_percent.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):151599
                                                                                                                                                                                                                Entropy (8bit):7.915992368779121
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
                                                                                                                                                                                                                MD5:83EC43F2AF9FC52025F3F807B185D424
                                                                                                                                                                                                                SHA1:EA432F7571D89DD43A76D260CB5853CADA253AA0
                                                                                                                                                                                                                SHA-256:A659EE9EB38636F85F5336587C578FB29740D3EFFAFF9B92852C8A210E92978C
                                                                                                                                                                                                                SHA-512:6DDCA85215BF6F7F9B17C5D52BD7395702515BC2354A8CD8FA6C1CCD7355A23B17828853CEABEEF597B5BCA11750DC7C9F6EC3C45A33C2106F816FEC74963D86
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:..........<.............h.....i.\...j.....k.I...l.....n.....o.....p.:...q.4...r.o...s.?...t..!..u..%..v.@'..w..1..x..<..y.l?..z..C..{..G..|..I..}..J..~..M.....O.....R....|V.....Z.....]....N`.....a....3c....gd.....e....@g.....g.....m....~s....Fw....&{.....~..........*.....m................8..........._...........1....V.............w....e........F.........'....Z....k....5...,.....-.h........./.....0.!...1.....6.f...7.....8..!....$....&...../.....1.....5....3:....CE.....F....(O.....U....b[.....`....g....^i.....m.....q....V{....v~..............R...............X.....#.................................................|.....S..........W...........i..........2.....`...........S...........S.....(............................s...........y.....N.....".......................&.............................................Q"....-#.....#....$....v%....?&.....&....*(.... ).....*...........2....33....3.....3.....4....5....v6.....6.....7....f7....7.....7.....>.....A....sB

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Programs\FlowUs\chrome_200_percent.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):228644
                                                                                                                                                                                                                Entropy (8bit):7.946488830213853
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
                                                                                                                                                                                                                MD5:DC48A33BD20BFC7CACFC925A84B015B6
                                                                                                                                                                                                                SHA1:8DFEE88FD1DC77F89AD88C19146FE3AB45E43F3C
                                                                                                                                                                                                                SHA-256:2C1B3E4B8A0CF837AE0A390FCA54F45D7D22418E040F1DFEA979622383ACCED6
                                                                                                                                                                                                                SHA-512:1D54EB5D2BA06AF0BA8F6B491B0D43F178A48AC82CDF383BEB265E732DDFC06BCA9692003FDFCE56F7F00AF97F29ACF046C73B891B8C561610098F9626EAF05A
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:..........<.........&...h.....i.....j.....k.....l.....n.....o.|%..p..*..q..-..r.85..s..:..t..>..u.CG..v..K..w.._..x._t..y.{y..z....{.4...|....}.m...~...............................................h.............................5.................t...........-.................D............$.....-....K9.....@....FH...bL...9O...nT...)U...jV...UZ....]...s`...xc...f....j...n..,.\r..-..s....ku../..v..0..w..1.Dx..6..x..7.....8.Q............................F................S..........{...........^.....@...........!....%....&/....R2....:....>....RH....R.....V....|X....Sa.....i....k.....n.....r.....y.....{....%..........`.....7...........................................0.....I..........;.....l.....b.....B.....%.....S.....m..........L...........R..........V...........g.....)........................!.....'....-....u3.....4.....5.....6.....8....:9.....:.....<....=....`?....$L.....\....v\.....\....;].....]....._....._....K`....`.....a....]a....a.....g.....k....Rl

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Programs\FlowUs\d3dcompiler_47.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):4916728
                                                                                                                                                                                                                Entropy (8bit):6.398031738914566
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
                                                                                                                                                                                                                MD5:A7B7470C347F84365FFE1B2072B4F95C
                                                                                                                                                                                                                SHA1:57A96F6FB326BA65B7F7016242132B3F9464C7A3
                                                                                                                                                                                                                SHA-256:AF7B99BE1B8770C0E4D18E43B04E81D11BDEB667FA6B07ADE7A88F4C5676BF9A
                                                                                                                                                                                                                SHA-512:83391A219631F750499FD9642D59EC80FB377C378997B302D10762E83325551BB97C1086B181FFF0521B1CA933E518EAB71A44A3578A23691F215EBB1DCE463D
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Joe Sandbox View:
                                                                                                                                                                                                                • Filename: G4fDWS1Fpd.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: a2zZyepQzF.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: cMqyGFCQHk.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: cMqyGFCQHk.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: Soltix.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: Soltix.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K......JK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Programs\FlowUs\ffmpeg.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):2929152
                                                                                                                                                                                                                Entropy (8bit):6.70454100720416
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:49152:ZBAnytEwrZu/3Q8rvnh2UGH6qfhtvRIdefZiC6Cry2:ZBFE6kfbrvnh21K+io
                                                                                                                                                                                                                MD5:5A168CB3EA9D0E7400BAABF60F6AB933
                                                                                                                                                                                                                SHA1:82A86CB7F42294AB4AD6669C19B92605D960B676
                                                                                                                                                                                                                SHA-256:AF5F1BC9F6A73750FA0C7BF17439700CFB3AB23E1393F0C9899825417E319B54
                                                                                                                                                                                                                SHA-512:7C1441ECD049543E38297A7B6929E9F3EB978422D0CE508FBE6350FFEBD297F947B8D9EC75BD2054142DCD8461EEF1BF110E040D0830DA977FDE8944BECE843D
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......#...................................................:...........`A..........................................*.......*.(.............9..............:.<5....*.......................*.(.....$.@...........H.*.8............................text.....#.......#................. ..`.rdata........$.......#.............@..@.data.........+.."....+.............@....pdata.......9.......+.............@..@.gxfg....+...0:..,...J,.............@..@.retplne.....`:......v,..................tls.........p:......x,.............@..._RDATA........:......z,.............@..@.reloc..<5....:..6...|,.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3zeadaj3.hr0.psm1

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ge052cd.plt.ps1

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hgyyl2rf.3d5.psm1

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_km2gld1p.itr.ps1

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\FlowUs.exe

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):188699136
                                                                                                                                                                                                                Entropy (8bit):6.758231694605685
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:1572864:Zwl41lgY+w9QLv1JWYc6UeOtUUGQUT1jdu4BPPuuwT2GOqiB1sr7zjg7ob753oUV:/F4oD0QdG09P
                                                                                                                                                                                                                MD5:122EEE4C63DBC533BA58218E75C43098
                                                                                                                                                                                                                SHA1:0F78646245DBCAD2F1E3737E6B19589F4897D341
                                                                                                                                                                                                                SHA-256:E21A75F17719AF6E2920AC0CC2E638CD22906DF3666B4A792C80A75DB2F7D447
                                                                                                                                                                                                                SHA-512:5B8C688594F1FE89359083563F184A8BEE63BD6EB915FECC42A4847DDB25A196FF13DE9A74F3D505614E403EAA492BF458F40B5CA7A515CB3D433CCEFDE2EAB5
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."......FH.........`IY........@.............................`~...........`..........................................d..k...0...h....`m......#...H.......... o..5..P.......................0...(....}H.@............................................text...*DH......FH................. ..`.rdata.......`H......LH.............@..@.data....H......L..................@....pdata....H...#...H.................@..@.gxfg....B...pl..D....-.............@..@.retplne......l......*...................rodata.......l......,.............. ..`.tls..........l......>..............@...CPADinfo8.....m......D..............@...LZMADEC.......m......F.............. ..`_RDATA.......0m......X..............@..@malloc_h.....@m......Z.............. ..`prot.........Pm......\..............@..@.rsrc.......`m......^..............@..@.reloc...5... o..6....0.............@..B................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\LICENSE.electron.txt

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1096
                                                                                                                                                                                                                Entropy (8bit):5.13006727705212
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                                                SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                                                SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                                                SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\LICENSES.chromium.html

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:HTML document, ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):9099045
                                                                                                                                                                                                                Entropy (8bit):4.754770173605162
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:24576:2o9dQ06p6j6j1WOwRiXjYmfy6k6mjK64jK6gjK6e6cjK6feGjl8PpE:BFOeGT
                                                                                                                                                                                                                MD5:6FF57C0AECCDF44C39C95DEE9ECEA805
                                                                                                                                                                                                                SHA1:C76669A1354067A1C3DDBC032E66C323286A8D43
                                                                                                                                                                                                                SHA-256:0BA4C7B781E9F149195A23D3BE0F704945F858A581871A9FEDD353F12CE839CA
                                                                                                                                                                                                                SHA-512:D6108E1D1D52AA3199FF051C7B951025DBF51C5CB18E8920304116DCEF567367ED682245900FDA3AD354C5D50AA5A3C4E6872570A839A3A55D3A9B7579BDFA24
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\chrome_100_percent.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):151599
                                                                                                                                                                                                                Entropy (8bit):7.915992368779121
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
                                                                                                                                                                                                                MD5:83EC43F2AF9FC52025F3F807B185D424
                                                                                                                                                                                                                SHA1:EA432F7571D89DD43A76D260CB5853CADA253AA0
                                                                                                                                                                                                                SHA-256:A659EE9EB38636F85F5336587C578FB29740D3EFFAFF9B92852C8A210E92978C
                                                                                                                                                                                                                SHA-512:6DDCA85215BF6F7F9B17C5D52BD7395702515BC2354A8CD8FA6C1CCD7355A23B17828853CEABEEF597B5BCA11750DC7C9F6EC3C45A33C2106F816FEC74963D86
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:..........<.............h.....i.\...j.....k.I...l.....n.....o.....p.:...q.4...r.o...s.?...t..!..u..%..v.@'..w..1..x..<..y.l?..z..C..{..G..|..I..}..J..~..M.....O.....R....|V.....Z.....]....N`.....a....3c....gd.....e....@g.....g.....m....~s....Fw....&{.....~..........*.....m................8..........._...........1....V.............w....e........F.........'....Z....k....5...,.....-.h........./.....0.!...1.....6.f...7.....8..!....$....&...../.....1.....5....3:....CE.....F....(O.....U....b[.....`....g....^i.....m.....q....V{....v~..............R...............X.....#.................................................|.....S..........W...........i..........2.....`...........S...........S.....(............................s...........y.....N.....".......................&.............................................Q"....-#.....#....$....v%....?&.....&....*(.... ).....*...........2....33....3.....3.....4....5....v6.....6.....7....f7....7.....7.....>.....A....sB

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\chrome_200_percent.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):228644
                                                                                                                                                                                                                Entropy (8bit):7.946488830213853
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
                                                                                                                                                                                                                MD5:DC48A33BD20BFC7CACFC925A84B015B6
                                                                                                                                                                                                                SHA1:8DFEE88FD1DC77F89AD88C19146FE3AB45E43F3C
                                                                                                                                                                                                                SHA-256:2C1B3E4B8A0CF837AE0A390FCA54F45D7D22418E040F1DFEA979622383ACCED6
                                                                                                                                                                                                                SHA-512:1D54EB5D2BA06AF0BA8F6B491B0D43F178A48AC82CDF383BEB265E732DDFC06BCA9692003FDFCE56F7F00AF97F29ACF046C73B891B8C561610098F9626EAF05A
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:..........<.........&...h.....i.....j.....k.....l.....n.....o.|%..p..*..q..-..r.85..s..:..t..>..u.CG..v..K..w.._..x._t..y.{y..z....{.4...|....}.m...~...............................................h.............................5.................t...........-.................D............$.....-....K9.....@....FH...bL...9O...nT...)U...jV...UZ....]...s`...xc...f....j...n..,.\r..-..s....ku../..v..0..w..1.Dx..6..x..7.....8.Q............................F................S..........{...........^.....@...........!....%....&/....R2....:....>....RH....R.....V....|X....Sa.....i....k.....n.....r.....y.....{....%..........`.....7...........................................0.....I..........;.....l.....b.....B.....%.....S.....m..........L...........R..........V...........g.....)........................!.....'....-....u3.....4.....5.....6.....8....:9.....:.....<....=....`?....$L.....\....v\.....\....;].....]....._....._....K`....`.....a....]a....a.....g.....k....Rl

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\d3dcompiler_47.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):4916728
                                                                                                                                                                                                                Entropy (8bit):6.398031738914566
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
                                                                                                                                                                                                                MD5:A7B7470C347F84365FFE1B2072B4F95C
                                                                                                                                                                                                                SHA1:57A96F6FB326BA65B7F7016242132B3F9464C7A3
                                                                                                                                                                                                                SHA-256:AF7B99BE1B8770C0E4D18E43B04E81D11BDEB667FA6B07ADE7A88F4C5676BF9A
                                                                                                                                                                                                                SHA-512:83391A219631F750499FD9642D59EC80FB377C378997B302D10762E83325551BB97C1086B181FFF0521B1CA933E518EAB71A44A3578A23691F215EBB1DCE463D
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K......JK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\ffmpeg.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):2929152
                                                                                                                                                                                                                Entropy (8bit):6.70454100720416
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:49152:ZBAnytEwrZu/3Q8rvnh2UGH6qfhtvRIdefZiC6Cry2:ZBFE6kfbrvnh21K+io
                                                                                                                                                                                                                MD5:5A168CB3EA9D0E7400BAABF60F6AB933
                                                                                                                                                                                                                SHA1:82A86CB7F42294AB4AD6669C19B92605D960B676
                                                                                                                                                                                                                SHA-256:AF5F1BC9F6A73750FA0C7BF17439700CFB3AB23E1393F0C9899825417E319B54
                                                                                                                                                                                                                SHA-512:7C1441ECD049543E38297A7B6929E9F3EB978422D0CE508FBE6350FFEBD297F947B8D9EC75BD2054142DCD8461EEF1BF110E040D0830DA977FDE8944BECE843D
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......#...................................................:...........`A..........................................*.......*.(.............9..............:.<5....*.......................*.(.....$.@...........H.*.8............................text.....#.......#................. ..`.rdata........$.......#.............@..@.data.........+.."....+.............@....pdata.......9.......+.............@..@.gxfg....+...0:..,...J,.............@..@.retplne.....`:......v,..................tls.........p:......x,.............@..._RDATA........:......z,.............@..@.reloc..<5....:..6...|,.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\icudtl.dat

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):10468208
                                                                                                                                                                                                                Entropy (8bit):6.265606239082294
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
                                                                                                                                                                                                                MD5:FFD67C1E24CB35DC109A24024B1BA7EC
                                                                                                                                                                                                                SHA1:99F545BC396878C7A53E98A79017D9531AF7C1F5
                                                                                                                                                                                                                SHA-256:9AE98C06CBB0EA43C5CD6B5725310C008C65E46072421A1118CB88E1DE9A8B92
                                                                                                                                                                                                                SHA-512:E1A865E685D2D3BACD0916D4238A79462519D887FEB273A251120BB6AF2B4481D025F3B21CE9A1A95A49371A0AA3ECF072175BA756974E831DBFDE1F0FEAEB79
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E...(...E...)...F...).."F...1..5F..`1..EF...N..XF..PN..hF...N..xF.......F.......F.......F..@....F.......F......F..0....F.......G......$G......7G......JG......]G..@...pG.......G.......G..@....G.......G.......G..@....G.......G..p....H..`....H.......H..@...AH......TH..p...gH.....zH.......H..`....H.......H.......H..P....H.......H......H..`....I......%I..P...:I......RI.....bI..@...uI.......I.......I.......I..P....I.......I.......I..0....I.......J... ...J.. !..-J..@$..=J...$..PJ...$..qJ.......J...<...J....&..J....&..J.. .&..J....&..K..`.&..K....&.3K....&.JK..0.&.aK....'.xK....'..K....'..K...(..K....(..K...O)..K....)..L..0Q*.>L..`.*.gL..Pi+..L....+..L...i,..L....,..L..P}-..M..@.-.,M.. .-.EM....-.\M....-.uM....-..M...$...M..0%...M....0..M...j0..M..`.0..N..p.0.1N....0.AN....0.TN..@.0.iN....0..N..0.0..N....0..N....0..N....1..N....1..N..

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\libEGL.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):493056
                                                                                                                                                                                                                Entropy (8bit):6.3672588781107775
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:0PfRujpqWG9btH+M1wLPfj9iDcHetGsHUN0dxI2H6sNkD4Fvh2W:eAWt+MWLPfjkVGbN0dxI2H63D4Bh2
                                                                                                                                                                                                                MD5:39CCF402A62F068A8C573B45EA96154D
                                                                                                                                                                                                                SHA1:57CEB915EA6F88C7FCCA35339BF951659C0338AB
                                                                                                                                                                                                                SHA-256:8649D77ACE8E5753B9A10E7AE3349AAFA9D8E3406BA9C8C36A59633A84B3C41B
                                                                                                                                                                                                                SHA-512:C4F9225C54D413176CB3DD2B26D429493FD056C7C283BC7A1C52B4A2059DBB11380DAF5D847BE1FF29F058BA0EF44D4BF66A3D9E9A600000DC8F6D20DFB2ED03
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .....l................................................................`A.........................................l......h{..(.......x....P..l?..............<....d.......................c..(.......@...........p~...............................text....k.......l.................. ..`.rdata..lr.......t...p..............@..@.data....K....... ..................@....pdata..l?...P...@..................@..@.gxfg... &.......(...D..............@..@.retplne.............l...................tls....!............n..............@..._RDATA...............p..............@..@.rsrc...x............r..............@..@.reloc..<............x..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\libGLESv2.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):8418304
                                                                                                                                                                                                                Entropy (8bit):6.508090684401189
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:98304:Q7XpFwEPVsR+1HYJnahAB4tVsX43wYMg:QXVrAtsw
                                                                                                                                                                                                                MD5:F055A130C79BD517BDB53B1F8A38BD3B
                                                                                                                                                                                                                SHA1:9FBA0AD4BA973BB285B23CC125004BAF61A98B5A
                                                                                                                                                                                                                SHA-256:45B53759392B81CE7D916B3F1CF02BE30289809BD31D09FC1524EF2609183B17
                                                                                                                                                                                                                SHA-512:D9DCB217F268862C577CACF4E9F84C63E02B647113D484338A74EB0B24FADD6D87B4E7A551DD1EF692BB38E44562BFF848982ACB62840D4F49F91A7751320E34
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......d...........N......................................`............`A........................................m.w.......x.d....p........}..H....................w.......................w.(.....d.@.............x.......w.@....................text.....d.......d................. ..`.rdata..D.....d.......d.............@..@.data.........y.......y.............@....pdata...H....}..J....}.............@..@.gxfg....-...........d..............@..@.retplne.....@...........................tls....B....P......................@..._RDATA.......`......................@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\af.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):533447
                                                                                                                                                                                                                Entropy (8bit):5.412080848029905
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:WEGL+ocurcdy6VGycsaja+H2Jyngae5Ig1eo0vMIlgL2pQ+FXZG2vt2pslFd5/51:W1+ozrc86VZBaja+H2Jyngae5Ig1eo0N
                                                                                                                                                                                                                MD5:D9BEC09B6C523DC3BCA9A81264B1BEED
                                                                                                                                                                                                                SHA1:EA4AE9DFF554C59994632F85AF25B36C049FB5B2
                                                                                                                                                                                                                SHA-256:0B5A45DE223CE8522CC296AF1E93477540EAA74867428307CC3A5CD21921B022
                                                                                                                                                                                                                SHA-512:6E7677F86F73EDFFB5D6162CA19BB7464465F0F485CE2971FB20AD3F57D9FAC56B7A21D378701F80E85FB185C3AF6A238F8C8707F5874BFFFFD79D881A54DD6E
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.....j.....k.)...l.4...n.<...o.A...p.N...q.T...r.`...s.....t.....v.....w.....y.....z.\...|.....}.........................................................................#.....2.....C.....V...........A.......................c.........................................M.......................F.......................!.....o.......................c.................$.....y.................0.......................,.......................7 ..... ..... ..... ....h!.....!....."....1"....."....."....."....."....E#.....#.....#.....#.....$....@$...._$....h$.....$.....%....L%....[%.....%.....&....B&....R&.....&.....&.....'.....'....n'.....'.....'.....'....7(.....(.....(.....(....1).....).....).....)....Q*.....*.....*.....*....1+....s+.....+.....+.....,....U,....z,.....,.....-....]-.....-.....-....*.....h.......................I/....u/...../...../....A0....|0.....0....#1.....1.....1.....2....}2.....2.....3....=3.....3.....4....54....H4.....4.....4.....4.....5....e5.....5.....5

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\am.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):861015
                                                                                                                                                                                                                Entropy (8bit):4.906916579483596
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:24576:HzD984ToH3hTCNRysrxQH9hjN3Rpzvh51muMXqVFq+XG/6WxLP5A:qn5N
                                                                                                                                                                                                                MD5:E3933DE22DC7FB98215B083D8A379F40
                                                                                                                                                                                                                SHA1:68DDBD9BCC931F0D4A172FA65AF35B823C7C9E37
                                                                                                                                                                                                                SHA-256:EAA747075E5A62BE8B7DF5908E167CCC5314C9C6A8B890059D00284A3C496FEF
                                                                                                                                                                                                                SHA-512:7BEB80FA029F41CB21536B15C604E2AE9DFC20B4A3EC4F5CC04E2B105D4B2C251830624957197084761F9686F95D332E25D4F6178509AD58257AF90D96A9E7D5
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.%...j.1...k.@...l.K...n.S...o.X...p.e...q.k...r.w...s.....t.....v.....w.....y.E...z.s...|.....}.................................................&.....'.....(.....-.....I....._.......................`...................................6.................S...........E...........P.................x.................S ..... .....!.....!.....!....P".....".....".....#....^$.....$.....$.....%.....&....c&.....&.....'.....'.....(....A(.....(....{).....).....).....*.....+.....,....H,.....,.....-....C-....v-.....-....N................../....w/...../...../....u0.....1....y1.....1....@2.....2....03....F3.....3....c4.....4.....4...._5.....5....16....P6.....6....T7.....7.....7....`8.....9.....9.....9....0:.....:.....:.....;.....;.....;....6<....^<.....<....c=.....=.....=....{>.....>....b?.....?....*@.....@.....@.....@.....A.....B....RB....qB....,C.....C.....D....7D.....E.....E....TF....nF....9G.....G....NH.....H....LI.....I....`J.....J.....J....FK....lK.....K....8L.....L....6M

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\ar.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):943328
                                                                                                                                                                                                                Entropy (8bit):4.930661249056055
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:NYI8HRnwBUC/+/RYfESugvPUB6m7kOCSn5KNp5QpnSKU/:SNHRnh5aQM
                                                                                                                                                                                                                MD5:AC865FF462F341B4317C3D16EEB40460
                                                                                                                                                                                                                SHA1:1E971D97F09884B23595F17534227EA43CF99090
                                                                                                                                                                                                                SHA-256:0557BC17EB1D134BD52F203836551B55579114708E2DF51F653972951567513D
                                                                                                                                                                                                                SHA-512:A935B91A2C053303E941866CFC151F28053FAF364AEECE98D61FCD68FEF6C6F1D3B73DE01CD602C8A4A081CCE452D1CE87F8166BA3C0E8B81E91D932F84737F2
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:........j(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.&...t.=...v.r...w.....y.....z.....|.....}.K.....t.....y.......................................................................L.....@.....#....................... .....|...........H...........m...........?...........L.....}.............................k............ ....) ..... ....a!.....!.....!....."....\#.....#.....#.....$.....%.... &....Q&.....&.....'.....'.....(.....(....l).....).....).....+.....+.....,.....,....p-.....-..........Y...........B/....u/...../.....0.....0.....0.....0.....1....Z2.....2.....2....h3.....3....,4....=4.....4....w5.....5.....5....q6.....6....57....L7.....7....W8.....8.....8....F9.....9....H:....e:.....:....d;.....;.....;....K<.....<.....<.....=....L>.....>.....>....U?.....?.....@....a@.....@....9A....\A....yA.....B.....B.....B.....C.....C.....C....KD....dD....lE....MF.....G.....G.....G....mH.....H.....H.....I.....J....EJ....\J.....J....%K....KK...._K.....L.....L....&M....HM.....M

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\bg.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):982837
                                                                                                                                                                                                                Entropy (8bit):4.669923863173967
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:24576:MhQgWoOYLYyzQkECvUPVbKDks373ZAW3AAK1mVDLpv74umpjd2SI5IxuFsoGQXxQ:VgWoOYLYfYUPVbKDks373ZN3ApmVDLpw
                                                                                                                                                                                                                MD5:7C37C8C9B4215089B6C16D22838D256B
                                                                                                                                                                                                                SHA1:8F2AFDC21353685353A0562452F4A79180E58829
                                                                                                                                                                                                                SHA-256:2EBD582DFAA3139CD6A03E9892A94A3D9BB6936E0B04085B8F2D27E1DEC0BC8A
                                                                                                                                                                                                                SHA-512:BEADD70E9D706576BFB6725617385F776E9F68C84D116B01187354D377E2C860899DA34F8C5A054C4BDE41A57E9AAC56445F6AC0B8DA8C75A424641A86FDD718
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i."...j.....k.=...l.H...n.P...o.U...p.b...q.h...r.t...s.....t.....v.....w.....y.B...z.p...|.....}.................................................#.....$.....%.....*.....L.....e.............................$.....U.................9.....c...........p...........Z.....P.......................r ..... ....F!....l!.....".....".....".....#.....#.....$.....%....b%....^&.... '.....'.....'.....(.....)...."*....X*.... +.....+....5,...._,....K-......................./.....0....N1.....1....C2.....2.....3....)3.....3....\4.....4.....4....z5.....6....J6....p6....'7.....7.....8....E8.....8....n9.....9.....9....l:.....:....0;....P;.....;....a<.....<.....<....n=.....=....J>....r>....m?....S@.....@....-A.....A....^B.....B.....B...._C.....C.....D....gD....CE.....E....^F.....F.....G....3H.....H.....I.....I....NJ.....J.....J.....K....(L.....L.....L.....M....8N.....N.....N.....O.....P....XQ.....Q....}R....7S.....S.....S.....T....dU.....U.....U.....V.... W....kW.....W.....X....dY.....Y

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\bn.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1267393
                                                                                                                                                                                                                Entropy (8bit):4.284356072775859
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:LEcoGqGB2le1abaCb6Ew/0WySZIS+xd2f/MHDrYfHBpxspSPrCXqB+iBbHRI8T51:LjJfa56/0z5XpCOXqB+iBbD5YqNn
                                                                                                                                                                                                                MD5:FC66ADF3DEAC72FD39105540DD2DAEFF
                                                                                                                                                                                                                SHA1:A53B54EFCC1285A226D605116F87D12F69942482
                                                                                                                                                                                                                SHA-256:EF50CFEBAF9E32EDEEC25D30197AC5899B3DB8A0676671F639D32BC48F3B3BD8
                                                                                                                                                                                                                SHA-512:0B77DAA056451D01A8CFB3FF1ACC08D34E64E0A32BB119C8837AE3D6E3D5195311427C6101EFD7E7BC9104AA369832BB12AAB3D4080C00DC39EDC98B6C0B949E
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.....j.....k.....l.#...n.+...o.1...p.>...q.D...r.P...s.....t.....v.....w.....y.....z.L...|.s...}...............................................................................0.....U.....................................................?.......................Z.................. ..... ....(!.....!.....".....#....N#.....$.....$.....%....+%....R&....0'.....'.....(.....).....)....^*.....*.....+....~,.....-....1-.....-.........../....E/....@0....*1.....1.....1.....3.....4.....4.....5.....5....k6.....6.....6.....7.....8....`8.....8.....9.....9.....9.....:.....:.....;.....;....:<.....<.....=.....=.... >.....>....{?.....?.....?.....@....9A.....A.....A....XB.....B....LC....rC.....D.....E....{F.....F.....G.....H.....I....QI.....I....sJ.....J.....J.....K....iL.....L.....M.....M.....N....^O.....O.....P....#Q....oQ.....Q.....R....5S.....S.....S.....T....{U....#V....\V.....W.....X.....Y.....Z....@[....B\.....\....L].....^.....^....W_....._....]`....$a.....a.....a.....b.....c

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\ca.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):598934
                                                                                                                                                                                                                Entropy (8bit):5.408962543645936
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:gVHfWsqPdf9nwWF47D1MeCi24b3Fe5PFFuN3Mw2juwHzejm0t3l3kb7TenzL8wOs:gV/WRdlnPyToiL6YhgMNxgCh5cxSas
                                                                                                                                                                                                                MD5:E1AC7F4C28177F68FAC3BE2375A9368C
                                                                                                                                                                                                                SHA1:3D7738699087468A748F9B1189D2F7621187D03B
                                                                                                                                                                                                                SHA-256:EFA1BA906F8ABCE91EBB9D6442B64E0D5AE7DAB78DDA8A49A6FED1A342C71B9B
                                                                                                                                                                                                                SHA-512:AEE8CB28EB02E2FB2155C8D093CF678284E3571F46B913F743DE3C6D0215C18B80866FF446F46ADA160860ED9C18AE9A4209424E7E0F0BA97C78A3FE9815CA5A
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.....j.....k.!...l.,...n.4...o.9...p.F...q.L...r.X...s.....t.....v.....w.....y.&...z.T...|.{...}.........................................................................%.....>.....^.....|.......................7.................S.....l.............................m.......................v.......................k...................................2.....`...........R.................- ..... ..... ..... ....I!.....!.....!.....!....c".....".....#....,#.....#....L$.....$.....$....3%.....%.....%.....%.....&....i&.....&.....&.....&....N'....{'.....'.....'....\(.....(.....(.....)....b).....).....).....)....H*....s*.....*.....*.....+....I+....V+.....+.....,....A,....R,.....,....D-.....-.....-..........\................../....L/....o/...../.....0....S0....h0.....0....N1.....1.....1....+2....r2.....2.....2.....3....^3.....3.....3.....4....c4.....4.....4....b5.....5....\6....w6.....6....c7.....7.....7....I8.....8.....8.....8....@9.....9.....9.....9....9:.....:.....:.....:

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\cs.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):616994
                                                                                                                                                                                                                Entropy (8bit):5.843791316218894
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:863oqX0hmR4QkWA9jN85ASh6mARAO52C+wH/NOKbJSBXR8QQ:VYPNB85AS0P52C+wH/NOeJS+
                                                                                                                                                                                                                MD5:92E3FD1EB47767A0CB5F6E734DE4EEC1
                                                                                                                                                                                                                SHA1:33053BFEAD1FA67160B6A3C417EC4559BFDCDCFB
                                                                                                                                                                                                                SHA-256:D269E16FBD9B2AFE95B148ECE22B2AC803768FB53EE42E1FAD0181F9DEC84544
                                                                                                                                                                                                                SHA-512:916D73D9B28B0600878418A06388C2ED61BFAF17807A16E1C157A30E5DA136C6B6F194E99D151C43B9AA35D101DE755CAA6DA69E1C8A50DD134F27A7F2ADC016
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.....j.....k.....l.....n.....o.....p.&...q.,...r.8...s.g...t.~...v.....w.....y.....z.4...|.[...}...........................................................................................4...........^.................<.......................i...........A.....Z...........?.....{.................U.......................D.....l.................T.................:.................+............ ....K ....c ..... ....6!....k!....{!.....!....k"....."....."....:#.....#.....#.....$....u$.....$.....$.....$....N%.....%.....%.....%..../&.....&.....&.....&.....'.....'.....'.....'....2(.....(.....(.....(....-).....).....).....)...."*.....*.....*.....*....:+.....+.....+.....+....f,.....,....)-....@-.....-.....-.....-..........Q.......................W/...../...../...../....]0.....0.....1....I1.....1.....1.....2.....2.....2.....3....13....F3.....3.... 4....a4....y4.....4....g5.....5.....5....E6.....6.....7....77.....7.....8....D8....Y8.....8.....9....49....H9.....9....":....\:

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\da.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):558889
                                                                                                                                                                                                                Entropy (8bit):5.449151445338137
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:Gqv1aOSLABh3359zVmh5OsfZh1seDrwwlQJWJwgIobwmPaHL95bpkUdRi3jd4xFm:GqonsMfPrWb55bpfddm
                                                                                                                                                                                                                MD5:43029018648D558F9BBF7A74C59EB281
                                                                                                                                                                                                                SHA1:90C6618CCCB4DB85D7485AE8D809EC3AF4763E70
                                                                                                                                                                                                                SHA-256:4BD88F6AB82842358987AAD384775B35198DD75C2CCE4CAE783208ED69296A7E
                                                                                                                                                                                                                SHA-512:9E8EF9D4367AD01F2F4E7DD6F9884E463729EE5A0F678FD16A3CE093C21EFC1D78041D5C6E45037F37BFD732E4833744485B00ACFDA2313A1D1E947993129A3D
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.+...j.7...k.F...l.Q...n.Y...o.^...p.k...q.q...r.}...s.....t.....v.....w.$...y.K...z.y...|.....}...........................................%.....,.....-...........0.....>.....N.....b.....{...........`.................!.......................l...........A.....]...........-.....].....q........... .....G.....T.................2.....@.................8.....R...........>.....z.................w.................. ..... ..... ..... ....l!.....!....@"....Z"....."....s#.....#.....#....A$.....$.....$.....$....(%.....%.....%.....%.....&....Z&....~&.....&.....&....R'.....'.....'.....'....W(.....(.....(.....(....K)....v).....).....)....**....P*....Z*.....*.....+....@+....N+.....+....I,.....,.....,.....-...._-.....-.....-.....-....<.....Z.....r............/....6/....F/...../.....0....h0.....0.....0....W1....|1.....1.....1....b2.....2.....2.....3....T3.....3.....3.....4.....4.....4.....4....q5.....5.....6....N6.....6.....7....J7....\7.....7.....7.....8.....8.....8.....8.....9

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\de.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):596603
                                                                                                                                                                                                                Entropy (8bit):5.5059525736264
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:55U5D5aDs3K7UpGg5aL9Xtt5fPMkUz1CTz:5eaDs3K7UpGg5aLRf53MtCTz
                                                                                                                                                                                                                MD5:3A8DE004B3A610271E1D1913B6D4B53B
                                                                                                                                                                                                                SHA1:236893C3F7B450E6AD8B4D54E1A62B2E635B42D6
                                                                                                                                                                                                                SHA-256:43C060182C92CAF4AEBF8FD7B913DFE017BEEA71E796E862EBF8746575948364
                                                                                                                                                                                                                SHA-512:B70F849CCF7DD9E72D71522591420E0BAA03FF74763B44563B0B3800BA3A88CB8B973FABB90BBB6653819947ECA47F70E347958E3C31AB226957F7313BC03554
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:........((C.e.....h.....i.'...j.3...k.B...l.M...n.U...o.Z...p.g...q.m...r.y...s.....t.....v.....w. ...y.G...z.u...|.....}...........................................!.....(.....).....*.....,.....=.....P.....b.....x.....2...........J....._...........b.................?...................................?.....W...........B.....p.................k.................:.............................'.....c............ ..... ..... ..... ....O!.....!....."....#"....."....O#.....#.....#....]$.....$....Q%....p%.....%....O&....q&.....&.....&....^'.....'.....'.....(....p(.....(.....(....1).....).....).....*.....*.....+....7+....G+.....+.....,....a,....r,.....,....W-.....-.....-............................j/.....0....W0....m0.....0....J1....l1.....1.....1....62....S2....f2.....2....93....b3....u3.....4.....4.....4.....4...._5.....5.....5.....5....q6.....6.....7.... 7.....7.....8....X8....n8.....8....|9.....9.....9....i:.....:....);....V;.....;....?<....l<.....<.....<....U=....~=.....=.....>.....>.....>

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\el.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1076241
                                                                                                                                                                                                                Entropy (8bit):4.759988949622547
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:24576:yvHcaFbu4FDYX9QCMDhWJXDsS7miHk3D2NpYRDojvmXgVT8y2IWYNQKlCt2rDQur:aHcaFbu4FDYX9QCMDhWJXDsS7miHcD2r
                                                                                                                                                                                                                MD5:58D6EAF71B9B73F5F7F057C73D0D92EC
                                                                                                                                                                                                                SHA1:16E0587753E7D2834F4CBB24FED45E7BD2F8F2F4
                                                                                                                                                                                                                SHA-256:8474879DE21C414D34C44CF0A8C91356A66DBD647308A4F994BE25BD1F93A89F
                                                                                                                                                                                                                SHA-512:AB24C9655BD68E4A64E257914A35DC84B5F791C58B396AE004BF5DA61DF19C02EF9CA572B8E63F15BAF3694AE1E540ADF74586F10D28D7EF90EDEEC982BCF28D
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.....j.....k.....l.(...n.0...o.5...p.B...q.H...r.T...s.....t.....v.....w.....y."...z.P...|.w...}...............................................................................S...........................................................T.....\.....0.................1...........F ..... ....C!.....!....)"....J"....."....~#.....#.....#.....$.....%.....%.....&.....'.....(.....(.....(.....)....t*.....*.....+.....+.....,....'-....R-....C............/...../.....0.....1.....2.....2....~3..../4....{4.....4....R5.....6....H6....m6.....7.....7.....8....<8.....9.....9....]:.....:....Q;.....<.....<.....<....y=....O>.....>.....>.....?....Y@.....@.....@.....A....QB.....B.....B.....C.....D....wE.....E....|F....DG.....G.....G....}H.....I....<I....XI.....J.....J.....K....0K.....L.....L....YM.....M....VN.....O....<O....cO.....P.....P....NQ.....Q....kR.....S.....S.....S.....T.....V.....V.....W.....X.....X....dY.....Y.....Z.....[....7\....h\....#].....]....W^....y^....._....z`.....`

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\en-GB.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):485863
                                                                                                                                                                                                                Entropy (8bit):5.521699894815275
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:Ll+Npdwk8sj7ahcbKdFk+ufMP9ezQSKrfaYdrcLlY5IPxZBcvRJ+G:Ll++143fMuQSK3Z5MxLG
                                                                                                                                                                                                                MD5:985558DE03BF486AEC1DAADD39CB508D
                                                                                                                                                                                                                SHA1:B693DDEF983E8AF212936202DDCA92D908378404
                                                                                                                                                                                                                SHA-256:1956D448A4D333638F3601D0DA976710CBE0A795504EB694BA18311FE586D195
                                                                                                                                                                                                                SHA-512:13D1C82B797AD4FF25A94A996F9FB52B530643A0E735F96E32B9E0698962770148D95DB7BEB91343D781FB84378A3E334AC0C1C913D8DBAE20F425BF0DC364D3
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........)d.e.....h.....i.....j.....k.....l.....n.....o.....p."...q.(...r.4...s.c...t.z...v.....w.....y.....z.0...|.W...}...........................................................................................'.................E.....Y.......................>.................:.....P.................$.....9.............................K.............................Y.....~.................L.......................:.....k.....y.................;.....K.................. ..... ..... ..... ....!!....5!....t!.....!.....!.....!....."....N"....m"....w".....".....".....#....##....}#.....#.....#.....$....^$.....$.....$.....$....)%....n%.....%.....%.....%.....&....V&....a&.....&.....&.....'....#'.....'.....'.....(.....(....|(.....(.....(.....(....>)....z).....).....).....)....>*...._*....n*.....*.....+....G+....m+.....+.....+.....,.....,....q,.....,.....,.....,....`-.....-.....-.....-....[............/...../...../...../.....0....-0.....0.....0.....0.....1....Q1.....1.....1.....1.... 2....m2.....2

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\en-US.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):490357
                                                                                                                                                                                                                Entropy (8bit):5.513411409378336
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:1kdXRDCwszpReMP9e0QcD2faYjNCu454ZxDng/t/XFLwB:1sUwGeM1QcDq+5UxOLwB
                                                                                                                                                                                                                MD5:752A3FEED3AB6C127767C8FABC9A40B6
                                                                                                                                                                                                                SHA1:4AF9F9C19904D3BEF154B469858DC44B1E630A75
                                                                                                                                                                                                                SHA-256:C6A6C5D7AB6119BBA712D6FE45FD385506D4D0DD8E4156CCA3925062F4502AC5
                                                                                                                                                                                                                SHA-512:AE96D4F391E36F8F741671B72EBD4B1AB2D049B2A99B95737FB9F81743B9E414B46022B65194AF5616EB354056ADDF0E46EF090F56B7D945EF2CB5F4D100D64F
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:........O)..e.\...h.d...i.l...j.x...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.9...w.e...y.....z.....|.....}.......;.....@.....H.....P.....X....._.....f.....m.....n.....o.....t.............................#.......................;.......................0.......................3.....~.......................S.....|.......................=.....J.............................z.......................l.......................H........................ ....^ ..... ..... .....!....^!.....!.....!.....!....*"....E"....T"....."....."....."....."....8#....u#.....#.....#.....#....J$....|$.....$.....$....&%....S%...._%.....%.....%.....&....!&....i&.....&.....&.....&....)'....n'.....'.....'.....(....](.....(.....(.....(....=)....`)....v).....).....).....*....1*.....*.....*.....*.....*....P+.....+.....+.....+....7,....n,.....,.....,.....,....7-....a-....q-.....-..........N.....f...........7/...../...../...../....J0.....0.....0.....0....@1....l1....{1.....1.....2...."2....22.....2.....2.....3

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\es-419.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):589663
                                                                                                                                                                                                                Entropy (8bit):5.378608358697393
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:cv+c/pQ8eguGEy1mVpDYl7G8oZOZ5zazaQ+ax891:cP3RsJpuGS5za9+D1
                                                                                                                                                                                                                MD5:85E9B056E3AC3F6A5B113ED9F460E202
                                                                                                                                                                                                                SHA1:DCCEEF6EA85D71A85DD24D17EC65371DCE76F480
                                                                                                                                                                                                                SHA-256:16FE83762ED578C49685868418325920A72CD457907BC4E5264F2C172D53B27B
                                                                                                                                                                                                                SHA-512:E4DFDE9C1260DF1F77B7EC1797658F8CFEAAB98142A8D512ED3BFAC054933A4583F20091B97985B4BA9CF93F9FACA3E7B0986CB4A3EB12FE0BC04EE1C45D3E0F
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.....j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.?...z.m...|.....}................................................. .....!.....".....$.....6.....E.....Z.....q.......................$.................A.....Y...........i.................`.................2.............................r...................................H.....x...........n.................P ..... .....!.....!.....!.....!....'"....>"....."....*#....r#.....#....%$.....$.....$....$%....v%.....%.....%.....&....[&.....&.....&.....&....R'.....'.....'.....'....l(.....(.....)....0).....).....)....2*....>*.....*.....*.....+....&+....x+.....+.....+.....,....p,.....,.....-....'-.....-..........f.................A/....p/...../...../....C0....j0.....0....41....j1....z1.....2....o2.....2.....2...._3.....3.....3.....3....U4.....4.....4.....4....y5.....5.....6.....6.....6....C7.....7.....7....N8.....8.....9....;9.....9....!:....e:....y:.....:.....;....5;....H;.....;....9<.....<.....<

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\es.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):589284
                                                                                                                                                                                                                Entropy (8bit):5.3587509940363995
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:Uxb0Q3M9BnWhau1WK4G0gkjqpT+ZbBQihXFijs5J+f2D//z/h6PZOkx:SAwx4Lep4BQiXijs5k2r/Lzk
                                                                                                                                                                                                                MD5:3DB06EA954C83343BD333C15947F521A
                                                                                                                                                                                                                SHA1:DDDE6AB9F9085E83EC8BF7A37DF3389040ACEA42
                                                                                                                                                                                                                SHA-256:45DF7340FE3C8560B11FFBA2219DE1B5C45DBFE57B6DB90BD6C246244FAE338A
                                                                                                                                                                                                                SHA-512:CC29F1075C119DADDAA108C17ABB6D572925CAC1ED2237ED2FD45364BFB2A00C1144FCCDD22C6728C954AF2CDD1B9477F39968BA25354BCA2B9DCA07F5C53DDE
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h."...i.*...j.6...k.E...l.P...n.X...o.]...p.j...q.p...r.|...s.....t.....v.....w.#...y.J...z.x...|.....}...........................................$.....+.....,.....-...../.....B.....R.....g.............................2.................Z.....p.............................}...........).....D.......................>.................(.....9...........3.....x...........'.......................k ..... .....!....*!.....!.....!....6"....K"....."....?#.....#.....#....7$.....$.....$.... %.....%.....%.....&.....&....t&.....&.....&.....'....f'.....'.....'.....(.....(.....(.....)....")....{).....).....*.....*....k*.....*.....*.....+....R+.....+.....+.....+....I,.....,.....,.....,....X-.....-............................./....-/...../...../.....0....$0.....0.....1....01....C1.....1....82.....2.....2.....3....i3.....3.....3.....4....g4.....4.....4....'5....w5.....5.....5....m6.....6....Q7....h7.....7....u8.....8.....8....g9.....9.....:....%:....w:.....:.....:.....;....l;.....;.....<

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\et.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):536344
                                                                                                                                                                                                                Entropy (8bit):5.456021867812121
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:HeaF27VNhXV9R5OJs99Z0+I+eL40dmFZxEYTHbtiPSia6OSt75H50MHsjiCKM2a6:HhFEVN53Q6Z8+wmFZq0SfH50MIW
                                                                                                                                                                                                                MD5:8E2C2CC8C516D8B7181C0C712CA24513
                                                                                                                                                                                                                SHA1:E0CCD9ED8DE6640379F822A067DCF97D4BBE44A7
                                                                                                                                                                                                                SHA-256:C96937F46FB1B1182B201F5C48FE1DA4D3F94A68A0E6E0699CCC0944CD0A5A33
                                                                                                                                                                                                                SHA-512:339BC655F22068F2EE9352A670325865265E4279197430214F7E3FBA575415318110CCCB03AED2C0E7AC673D4629BD495DC34A56CEFBCAAB62E1C4A1A87ED8C2
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.2...h.:...i.K...j.W...k.f...l.q...n.y...o.~...p.....q.....r.....s.....t.....v.....w.D...y.k...z.....|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P.....`.....r...................................$.................#.....6.................U.....k...........4.....d.....v...........,.....Y.....d.................F.....Y.................C.....a...........?.....z.................^.......................f ..... ..... .....!....r!.....!.....!....7".....".....".....#....p#.....#.....#.....$....^$.....$.....$.....$....>%.....%.....%.....%....6&.....&.....&.....&....B'.....'.....'.....'....L(.....(.....(.....(....C).....).....).....)....C*.....*.....*.....*....\+.....+.....,....&,....y,.....,.....,.....-....j-.....-.....-..........d................../....f/...../...../....(0....t0.....0.....0.....0....Y1.....1.....1.....1....g2.....2.....2.....3.....3.....4....f4....z4.....5.....5.....5.....5....Z6.....6.....6.....7....\7.....7.....7.....7....>8.....8.....8

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\fa.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):876080
                                                                                                                                                                                                                Entropy (8bit):5.051372514206481
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:24576:nrL8u313uyqoT+seqyRmX5loTUOmdAQifaQ2XxFMJGk62YhYaiiIQMX4qOwUCMdq:ng56I
                                                                                                                                                                                                                MD5:CAEE902136579F4BAC72A6F0F75D171B
                                                                                                                                                                                                                SHA1:CBBAF988A499005E21FD86652E1F48AF8BCE2C35
                                                                                                                                                                                                                SHA-256:E86F677E9654F6A16A7738E85A5A5D467A09CB18E47654F079506A00AFFAD70C
                                                                                                                                                                                                                SHA-512:C0F2E8457F71789DA8CE207AAAE2F83196DAAC868FCAA7A84DE04DD38730F8831B9643B8A404A7AA59C5B726DA02090BBA414529019F5EB9C94AC5A5AF61BC9D
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:........R(..e.b...h.j...i.u...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.B...w.n...y.....z.....|.....}.......D.....I.....Q.....Y.....a.....h.....o.....v.....x.....}...............................................>....................... .................'.....P.................%.....L...................................$ ....n ..... ....4!.....!....."....=".....".....#.....#.....$.....$....G%.....%.....%....I&.....&....7'....U'.....(.....(....4)....V)....'*.....*....u+.....+.....,.....,.....,.....,....w-..........;.....L...........l/...../...../....\0.....0....L1....a1.....1.....2.....2.....2....i3.....3..../4....B4.....4....^5.....5.....5....K6.....6....-7....>7.....7.....8.....8.....9.....9.....:....I:....l:.....;.....;.....;....1<.....<....Z=.....=.....=.....>....(?....z?.....?....?@.....@.....@.....@.....A....WB.....B.....B....qC.....D....OD....pD....nE....fF.....G....-G.....G.....H.....H....$I.....I.....J.....J.....J....~K.....K....&L....GL.....L.....M.....M.....N

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\fi.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):547257
                                                                                                                                                                                                                Entropy (8bit):5.425790227406111
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:sXTpn19l5MtWuah5EinUtWnSp0WahHNYM:yTlB5E8nRl
                                                                                                                                                                                                                MD5:125A121C22DFC2B1A1C759CAD9123E42
                                                                                                                                                                                                                SHA1:D0282AF9EC311C406ECCCDFDD7216B7D883E94C3
                                                                                                                                                                                                                SHA-256:B733460F039DCB3795077BA91DAFA3B9B8163DFD0F15168B250630F7DE21ED0A
                                                                                                                                                                                                                SHA-512:C6E0EA8FAB8115A632D4C74141EFC46EA546F43E0B806D5BD95A1ECD3B8FE37A44565A2F79C43E0BC50DBDADC5D16054E07485FAD83C99BD3550A907C852E724
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:........F(%.e.J...h.R...i.c...j.o...k.~...l.....n.....o.....p.....q.....r.....s.....t.....v.0...w.\...y.....z.....|.....}.......2.....7.....?.....G.....O.....V.....].....d.....e.....f.....k.....}.......................@.................$.......................0.................G.....]...........1.....d.....y...........&.....S.....a.......................'.........................................8.....R.................0.....F.................5.....J............ ....8 ....V ..... ....@!.....!.....!.....!....K"....n".....".....".....#....A#....O#.....#.....#.....$....'$....w$.....$.....$.....$....V%.....%.....%.....%....;&.....&.....&.....&.....'....n'.....'.....'.....'....M(....v(.....(.....(....`).....).....).....*....R*....n*.....*.....*....2+....T+....m+.....+....0,....T,....c,.....,..../-....f-.....-.....-........../.....>................../....1/...../...../....&0....@0.....0....C1.....1.....1.....2....q2.....2.....2....$3....|3.....3.....3.....3....A4....Z4....j4.....4.....5....I5

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\fil.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):618874
                                                                                                                                                                                                                Entropy (8bit):5.2024833562888055
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:fGsQ2sSp+ynDQmiSANIhxp3amx5GhV7MQoE8AYzwK:fiolx5G7s
                                                                                                                                                                                                                MD5:EAF43729E9BBD8004EF1FF56A3D85A48
                                                                                                                                                                                                                SHA1:34B31AB8EA2CE6BD263F00ACC50D5AF8D0222D9A
                                                                                                                                                                                                                SHA-256:8559CC35335BB2C249297F4C7506DF95CEF899EF5F7AD942D2D511AE074D41B0
                                                                                                                                                                                                                SHA-512:010F8E5C3B969BE0DB4BAEC3ACFFDD69BE25662387968E15E11AF0DA68EC2F45DC9EDB83CAFE7C92234E1E4E4AAE1682223235AF04D99E8B5238379E022E3D35
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:........*)A.e.....h.....i.0...j.<...k.K...l.V...n.^...o.c...p.p...q.v...r.....s.....t.....v.....w.)...y.P...z.~...|.....}.....................................#.....*.....1.....2.....3.....8.....E.....Z.....p.........../........... .....:...........1.....v...........3........... .....G...........<.......................`.......................s.................J.................* ..... ....@!.....!.....!..../".....".....".....#....~#.....#....*$....D$.....$....?%.....%.....%....8&.....&....$'....F'.....'.....(....0(....M(.....(.....(....#)....0).....).....).....*.....*.....*.....*....5+....K+.....+.....,....M,....\,.....,.....-....Q-...._-.....-.... .....Q....._..........."/....T/....b/...../....c0.....0.....0....41.....1.....1.....1.....2.....2.....2.....2.....3....}3.....3.....3....G4.....4.....5....75.....5.....5....(6....B6.....6.... 7....S7....n7.....7....b8.....8.....8....k9.....:....n:.....:.....;.....;.....;.....<.....<.....<....,=....D=.....=.....=....$>....:>.....>....0?....l?

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\fr.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):637414
                                                                                                                                                                                                                Entropy (8bit):5.391270599351283
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:ZPM7ZL85Z4p5ZR6QuaMVq0YzRnP4ZoZCMYnYyGGGDYQzc7IvO8Ixat40wCSsmlFI:ZPiYVW45F2
                                                                                                                                                                                                                MD5:651E4CB14C4F784D36D0A1715C52DCF3
                                                                                                                                                                                                                SHA1:540F6090E3223AD8E6424A9DB78305F2DB9974BF
                                                                                                                                                                                                                SHA-256:6D547CBC3304627D14AEB138AEBD40786C30A4192E071D80BCECDB77A13AC80A
                                                                                                                                                                                                                SHA-512:1FE93058EC434C06EF4AA1519333EBD831311971B06D7279DDC4D86DFA860BBD6EA6D127B2A07425C3E78BD6D41C11EB2A76CF25B20C6A7DE74D1F0CEEC87079
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.....j.....k.....l.....n.....o."...p./...q.5...r.A...s.p...t.....v.....w.....y.....z.=...|.d...}.....................................................................................$.....3...........{.................u...........*.....B...........`.................H.................+.........................................*.....?...........4.....w...........&.......................b ..... .....!....&!.....!.....!....;"....N"....."....9#....{#.....#....($.....$.....%....4%.....%.....%....*&....A&.....&.....&.....'..../'.....'.....'..../(....A(.....(.....)....G)...._).....)....(*....\*....q*.....*....#+....O+....]+.....+.....,....<,....K,.....,.....-....A-....U-.....-....X.................7/...../...../...../....)0....{0.....0.....0.....1.....1.....1.....1....s2.....2.....3....i3.....3.....4.....4....D4.....4....05....l5.....5.....6....t6.....6.....6....c7.....7....48....G8.....8....99....~9.....9....1:.....:.....:.....;....q;.....;.....;.....<.....<.....<....7=

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\gu.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1247969
                                                                                                                                                                                                                Entropy (8bit):4.3234098874611675
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:dYXCzHrul8BRuh7x4kvm/RbIwjAwREJKVMjNiT7llj63rFulPCaSi5NAWsWi//Go:SgruQuhd4kOv0wv5qdhX11oG
                                                                                                                                                                                                                MD5:6C949199EAAAD8FCB12C38EC6C02D758
                                                                                                                                                                                                                SHA1:CE4DBD5E6A37F25354EC6849F7008956EF3568BA
                                                                                                                                                                                                                SHA-256:966591A74E44C75C7F0114BB8E36B0E9F5502AEBDC96C714C8A8F6D45BC863C8
                                                                                                                                                                                                                SHA-512:3344E0083969DE6F4913893A14586B441F65CB5D45F913F1CEA61B8D5ABBDB3B1C18A48731870282174263C1F306ED6B99C279627BD269E89CD4E15DC3D88313
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.....j.....k.)...l.4...n.<...o.A...p.N...q.T...r.`...s.....t.....v.....w.....y.....z.\...|.....}.........................................................................8.....]......................."...........B.....5...........y.......................p.................7 ..... ..... .....!....."....h"....."....H#.....#....2$....R$....5%.....%....P&.....&.....'.....(....,)....n)....D*.....+.....+.....+.....,....k-.....-.........../.....0.....0.....0.....1.....2.....3.....3....q4.....5....F5....m5....&6.....6.....7....C7.....7.....8.....8.....8.....9....s:.....:.....;.....;....|<.....<.....<.....=....S>.....>.....>....g?.....@....n@.....@....@A.....A....KB....jB....}C.....D....2E....hE....!F.....F....(G....QG.....G....VH.....H.....H....WI....8J.....J.....J.....K.....L....JM.....M....oN.....O....RO.....O....gP....-Q.....Q.....Q.....R....zS.....T....<T....cU.....V....^W.....W.....X.....Y.....Z....fZ....R[.....\.....\.....\.....]....I^.....^.....^....._.....`....ta

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\he.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):769483
                                                                                                                                                                                                                Entropy (8bit):4.624517967326664
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:HwRkrhVzCDkVF2TWrqnV3mWqu/rHQxssACnX+8eQCajZ5Q69Zt+yr4w5ONmmEkcU:QU5J+f
                                                                                                                                                                                                                MD5:16562C59FBA469E1DD2F3B0B87A64645
                                                                                                                                                                                                                SHA1:9A6863205FCA8EA6D09A98B8E8DAB543FF6198A1
                                                                                                                                                                                                                SHA-256:64FA2E98A9056E23C3A934FF39FEF81C306CEC5844D56DDA17EC6C25FCDB1B5A
                                                                                                                                                                                                                SHA-512:DBB6E1A5E52A005386007F88B53109037792BC7B65FB95ACE3E8CC5AE3EBD8320C7E406381C375BF751A9265ACE84E0BBE1301D4BF3AA79200EC789DC3B3BC0B
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.F...t.]...v.....w.....y.....z.....|.:...}.k.........................................................................................0.................(.....J...........H................._...........R.....r...........z.................p.........../.....@...........#.....R.....t...........o.................v ..... ....D!....h!.....".....".....".....#.....#.....#....=$....T$.....$....Y%.....%.....%....|&.....'.....'.....'....2(.....(.....(.....(....m).....).....*.... *.....*....<+.....+.....+....&,.....,.....,.....,....n-.....-....".....7............/....X/....i/...../....Q0.....0.....0.....1.....1.....1.....1....|2.....3....T3....s3.....3....[4.....4.....4....%5.....5.....5.....5....^6.....6.....7....67.....7....I8.....8.....8....>9.....9.....9.....9....R:.....:.....:.....:.....;.....<....d<.....<....\=.....>.....>.....>....X?.....?.....@....P@.....@.....A.....A.....A....wB.....B.....C....3C.....C....vD.....D

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\hi.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1316094
                                                                                                                                                                                                                Entropy (8bit):4.298990624339052
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:Pk/xu63zEz67Esk0GjV/BB0ZV1dKu4lYvD6OEOTByntDPtDlZpfRQhs4fe/8bR8E:8/xt3zEMEn0WXo5CKMhZQ
                                                                                                                                                                                                                MD5:6AA92C296ED09FE2AA94DC060B25774A
                                                                                                                                                                                                                SHA1:7619ED3DC5B1E04C55B0EE7280AC2D0135EB9C80
                                                                                                                                                                                                                SHA-256:0C771C66DB4F80A62912564944C4E239F8DAC8381A06483ECAB512E0D75744A1
                                                                                                                                                                                                                SHA-512:9255A4FFEF7BE07CEAB5DD8F46365B9A52D621AE175C1022BB4685FE4F3EA63425F45AA9EF824B467B9C33C51A7104258E888E8EC15C88FEA126BF0B5337FF14
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:........_(..e.|...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.-...v.b...w.....y.....z.....|.....}.;.....d.....i.....q.....y.................................................................E.....~...........X.................v...........;.....i...........x.................. .....!....N!....!"....."..../#...._#.....$.....$.....%....5%.....&.....&.....'....\'.....(....e).....).....*.....*.....+....',....P,....7-.....-....e............/.....0.....1....O1.....2.....3....L4.....4....`5.....6....f6.....6....J7.....7....N8....y8.....9.....9.....9.....9.....:.....;.....;....,<.....<.....=.....=.....>.....>....{?.....?.....?.....@....;A.....A.....A....cB.....C....uC.....C.....D.....E....%F....UF.....G.....G.....H....5H.....H....QI.....I.....I....iJ.....K.....K.....K.....L....ZM.....M....4N.....N....zO.....O.....O.....P.....Q....TR.....R.....S....:T.....T.....U....qV.....W.....X.....X.....Y.....Z....$[....f[.....\.....].....^....m^....a_.....`.....`.....`.....a.....b.....c

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\hr.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):594999
                                                                                                                                                                                                                Entropy (8bit):5.5194556553046565
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:ISmsqAZ/pqidI7/Rw6GhT0ww57V9YMrbLPDK:ISm/iEidI7/Rw6q0B5jYAzK
                                                                                                                                                                                                                MD5:FDA338824B4171B10DCC3395A549FA9F
                                                                                                                                                                                                                SHA1:EA42C8B18228E0CA57B8ED7ED48E3A2AEBE08486
                                                                                                                                                                                                                SHA-256:43F370368B322CD1236632C82AA0E231965DC58FDD497F8AEAE6B40EEF9EE611
                                                                                                                                                                                                                SHA-512:9115F805F51F45839E0A87CF44C1CCE311CECAF717C0DA7DB3B6DA85CEA95F24638AF29DA43BC01056994B22049DAA0387CD4371C13B8E5399FE8F4E38771D57
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.$...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...q.....r.....s.....t.....v.....w.6...y.]...z.....|.....}.........................!.....).....0.....7.....>.....?.....@.....B.....N.....Z.....h.....y.......................#.................'.....<...........3.......................s.................".............................f.......................r.................O.................<............ ....L ....d ..... ....(!...._!....s!.....!....["....."....."....U#.....#....B$....e$.....$.....%....:%....V%.....%.....%.....&.... &....f&.....&.....&.....&....D'.....'.....'.....'....H(.....(.....(.....(....G).....).....).....)....H*.....*.....*.....*....,+.....+.....+.....+....<,.....,.....,.....-....j-.....-.....-.....-....T.......................2/...../...../...../....F0.....0.....0.....1....{1.....1.....1.....2....v2.....2.....3.....3.....3.....3....P4....m4.....4....y5.....5.....5....b6.....6.....7....-7.....7.....7.....8....08.....8.....8.....8.....8....j9.....9.....:

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\hu.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):640919
                                                                                                                                                                                                                Entropy (8bit):5.644940180075165
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:oeo/GHgmRXxhsRd9gHo2pKJDAxukitluTd5kt8zZ9pwJcYNV9SLg+4ev6DbnjDiw:Ho/GBwHAZd5kt8Ex9y+O5LG9b
                                                                                                                                                                                                                MD5:7ADD28FBBBA1CE87972F6433862DCBAA
                                                                                                                                                                                                                SHA1:8B4B0053663C0B69BECA59FACA79854A89AB9C97
                                                                                                                                                                                                                SHA-256:DD86976D72F3CB644B90C1863E29E2F8616B09AC4ACFE9301FB346FA0D87BD78
                                                                                                                                                                                                                SHA-512:EFED0891B0202BAE9396DF54F141A73BB6CCADD7947330FD9E6A3A8911E9E037454238C4BD2BB9075AF3218230C9E4E394F83A70878396911FAA282D99FDD884
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.D...t.[...v.....w.....y.....z.....|.8...}.i.....................................................................................................~.............................L....._...........c................._.................'.................(.....9.................H.....i...........i.................s...........X ....| ..... ....b!.....!.....!....!"....."....."....."....s#.....#....6$....P$.....$....s%.....%.....%....\&.....&.....'....-'.....'.....(....,(....D(.....(.....)....G)...._).....).....*.....*.....*....U+.....+....+,....A,.....,....L-.....-.....-............................Z/...../.....0....B0.....0....W1.....1.....1....#2.....2.....2.....2....J3.....3.....3.....3....`4.....4.....5.....5.....5.....6....i6.....6.....7....U7....y7.....7.....7....T8.....8.....8....(9.....9.....9.....9.....:....,;.....;.....;....R<.....<...."=....V=.....=....e>.....>.....>....8?.....?.....?.....?....q@.....@....'A

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\id.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):529383
                                                                                                                                                                                                                Entropy (8bit):5.3800306514954634
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:MB38e1B6x8b+tQqAHcAef+eVnjHF/TmiZAWO5AVpWOBhUnNiT8kLHp:MB38erqPA2VnjHFbm8At5AVpLp
                                                                                                                                                                                                                MD5:CFC848689A25F5E2E6BA9A06E09B6EE0
                                                                                                                                                                                                                SHA1:35131E775D98A57FFCBD6A75E69F6F67437636C3
                                                                                                                                                                                                                SHA-256:EC1D7BBE064656DC53F70E3A612A582F5D5D0AF5F0C2D6A783796CFFA5BF7F57
                                                                                                                                                                                                                SHA-512:D5A027E35DD3846F5255B81EED36A3498AC9D809367692B2DA216B5771C2D54FAD35FC15C15705A2BBB4A7B35DD2245661882734998F9BC3AD8D62D2273B6577
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.....j.....k.(...l.3...n.;...o.@...p.M...q.S...r._...s.....t.....v.....w.....y.-...z.[...|.....}......................................................................... .....-.....=.....O...........5.....}.................6.....c.....o...........6.....y.................P.......................K.....{.......................=.....T.................B.....f.................P.....g.................4.....A.......................#.................$ ....7 ..... .....!....W!....k!.....!.....!....."....."....g"....."....."....."....-#....x#.....#.....#.....$....Y$.....$.....$.....$....>%....m%....w%.....%.....&....B&....L&.....&.....&.....'....('.....'.....'.....(.....(....q(.....(.....(.....)....Y).....).....).....).....*....T*....s*.....*.....*....2+....]+....p+.....+.....,....G,....i,.....,.....,.....-.....-....w-.....-.....-..........v................../...../.....0....f0....u0.....0....?1....y1.....1.....1....F2....t2.....2.....2.....3....,3....<3.....3.....3....24

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\it.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):581016
                                                                                                                                                                                                                Entropy (8bit):5.296715563664076
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:Mkqu5NjNJ2IU9UTx994eN7NgvESIqRRxsO1ytnvWjRT9Tj+rhazYDxrvAqpzSw9S:MkSLlZm128uJekfzEpe5kLISa
                                                                                                                                                                                                                MD5:6AA3BC3EE4999C324B82E50940E62C74
                                                                                                                                                                                                                SHA1:10AF8030FC2F875E133C9417E0221528160AD8B5
                                                                                                                                                                                                                SHA-256:73CC8422643A65753B2C3672C8F8331EE92C9BDDC912576554E95B0986CF990D
                                                                                                                                                                                                                SHA-512:F039EF32002E55D09A4F567CC81FE2B3B329D517C985436A5DA121FF0E6AC7E258B5D1FDDA81E6C1578DAF7078B91ABCFB7DA98CDBA6693D4FBE7F28115E6971
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.....j.....k.....l.!...n.)...o.....p.;...q.A...r.M...s.|...t.....v.....w.....y.....z.I...|.p...}...............................................................................".....;.....L...........u.................d...................................r...................................G............................._.......................v................._.................S..........." ....h ....y ..... ....9!....s!.....!.....!....`"....."....."....G#.....#.....$....,$.....$.....$.....%....$%....t%.....%.....%.....%....@&.....&.....&.....&....#'.....'.....'.....'....+(....~(.....(.....(.....)....Y).....).....).....)....-*....[*....d*.....*.....+....:+....E+.....+....,,....z,.....,.....,....6-...._-....x-.....-.....-.................................../...../...../..../0....l0.....0.....1....31....H1.....1.....1.....2....!2.....2.....3....Y3.....3.....4.....4.....4.....5.....5.....6....[6.....6.....7....r7.....7.....7....!8....a8.....8.....8.....9....c9.....9

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\ja.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):708098
                                                                                                                                                                                                                Entropy (8bit):5.712005061370792
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:SCG5Mw77QWN7v5DD79ZgQ21XymbA5zFLdbvVt:SrSw7NN7F9ZgQ21Xi5zFLdj
                                                                                                                                                                                                                MD5:5A69547F56DC61E482DCDA1CE704C5AC
                                                                                                                                                                                                                SHA1:5B7BBC8E9B14D78F2105136AFB7728050128C02E
                                                                                                                                                                                                                SHA-256:A286A5FAF9021927EC09FD8CBF30ED14AD59C3BAA36D29E5491AD27B957915E5
                                                                                                                                                                                                                SHA-512:2B9D020544201E2D0B0B44B0977FCBAB858563969CE02BE65689C5F5B780ADC4560DF523589293CD66F42903322ED61D781DA093ADFA44AA0681A28D97DE4556
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........'..e.f...h.n...i.y...j.....k.....l.....m.....o.....p.....q.....v.$...w.P...y.w...z.....|.....}.......&.....+.....3.....>.....F.....U.....Z.....b.....i.....p.....w.....y.....~.........................................l...................................p...........S.....n.....4...........P.....{...........k.......................|.................H............................. .....g.................h ..... ..... .....!.....!.....!.....!....6".....".....".....".....#....4$.....$.....$.....%....w%.....%.....%....;&.....&.....&.....'.....'....%(....l(.....(....4).....).... *....D*.....*....I+.....+.....+....#,.....,.....,.....,....j-.....-..........+...........6/...../...../....80.....0....(1....G1.....1....A2....{2.....2.....3.....3.....3.....3....Z4.....4.....5....35.....5....?6.....6.....6....*7.....7.....7.....7....B8.....8.....8.....9.....9.....9.....:....5:.....:....|;.....;.....;.....<.....=...._=.....=.....>.....>.....>.....>....z?.....?...."@....>@.....@....LA.....A.....A

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\kn.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1424056
                                                                                                                                                                                                                Entropy (8bit):4.241400387342817
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:X3WMqESgQzb4OpsJHVLl6S3AE745LmWA4hqSm2G:Nqed65qWo
                                                                                                                                                                                                                MD5:52A0707A70B939BCD75B0838A5DC5357
                                                                                                                                                                                                                SHA1:EB9E1350D9D217580B1939302D008DC07C3B781C
                                                                                                                                                                                                                SHA-256:B177EDA102B1BE8C53127E3BB47970A3C1E2032BE24900D8A126C5F0F077EF3D
                                                                                                                                                                                                                SHA-512:D5FE69035338C4308F661FA0AC25C4A811A6014F6BD85CCC7AD947F76AECF76F67208512E1266E249EC067A5FB22FB74A3550B0F3AEB1BC50FADB3A9D3CC67E4
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.B...h.J...i.[...j.g...k.v...l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.T...y.{...z.....|.....}.......*...../.....7.....?.....G.....N.....U.....\.....].....^.....c.......................].............................D.....L...........[.................. ..... .....!....."....`#.....#....\$.....$....S%.....%....t&....='.....'.....'.....).....)....t*.....*....5,....D-..........|....../....V0.....0....%1....42.....3.....3.....3....,5....B6.....7....T7.....8.....9.....:....C;.....;....u<.....<.....<.....=....C>.....>.....>....X?.....?....A@....V@....9A.....A....zB.....B.....C....BD.....D.....D.....E....EF.....F.....F.....G....sH.....H.....I.....I.....J.....K....CK....eL....dM....$N....SN....6O.....O....TP.....P....AQ.....Q.....R..../R.....S.....S....1T....cT.....U....SV.....V....hW....PX.....X....UY.....Y.....Z.....[....*\....|\.....].....^....W_....._....+a.....b.....c.....c....;e....9f.....f....og.....h.....i....2j.....j....Lk.....k...._l.....l.....m.....n....`o

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\ko.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):599188
                                                                                                                                                                                                                Entropy (8bit):6.077314293748852
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:Twg3X8cvlA/t0ZTvIXzxMSAG0GlzRXhw3zTt8Onat7DXCqYwHs5Ra1i7vlq5zULq:TH75vKpCWj
                                                                                                                                                                                                                MD5:4B563EB612D4FADC6BD8A4C918006AB1
                                                                                                                                                                                                                SHA1:4B9E414AF0C044C4487D1439D23EF11B0169D308
                                                                                                                                                                                                                SHA-256:E0D4461452607E0F4A619EFE653EC9EC39F7D34A742AE98374B2BCE0B821ADC9
                                                                                                                                                                                                                SHA-512:B8C56D69FA41AD14F7197ACAB1BA987EBB06C5B15748E21CEC27861721545E30FB20F76F2C3A752C8EA94CCA1E6B4FAB7FB0727B679A8FB8E94DB2D5C028E7A6
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........'..e.....h.....i.%...j.0...k.\...l.d...m.l...o.....p.....q.....r.....s.....t.....y.'...z.U...|.|...}.........................................................................+.....;.....N.....^...........Q.................(.......................[.................#.................5.....I.................<.....L.................?.....R.................B.....]...........;.....p.................?.....m.....z...........1.....].....j...........<.....t............ ..... ..... ..... ....P!.....!.....!.....!....0"....~".....".....".....#....Y#....~#.....#.....$....r$.....$.....$....3%.....%.....%.....%....>&.....&.....&.....&....E'.....'.....'.....'....B(.....(.....(.....(....`).....).....*..../*.....*.....*.....*.....+.....+.....+.....,.....,.....,.....,.....-.....-.....-..........L.....|............/...../....+/...../...../.....0....(0.....0.....0.....1....-1.....1....+2....q2.....2.....2....X3.....3.....3.....4....h4.....4.....4.....5....]5....}5.....5.....5....R6.....6.....6.....7

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\lt.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):644262
                                                                                                                                                                                                                Entropy (8bit):5.6356477666035865
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:kjFt+0US0MAcrMqecJwuxZ5b7MjC3jqt6S0M:WFQ0GMnrLZ5sjIjqN
                                                                                                                                                                                                                MD5:7CEF6E31D76861DB4D7D622FDD89E5AA
                                                                                                                                                                                                                SHA1:31FA45C3B7666259D4D8A13518ECE423A97EDCCA
                                                                                                                                                                                                                SHA-256:2F1E1C69DA5CAD8F47E45AF0AC47CEC90C20FE2897A43CB496C7FEED1EC5D1AB
                                                                                                                                                                                                                SHA-512:DF66A739F3A8DA62A942B56B23F71A2B68469E87DC44EB8CE1A9A859A609F1DB4BEE2497DEFEF06FA48E14CF461E61410668A5216459C94C79F4B69A3CF092F6
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.#...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.C...z.q...|.....}.................................................$.....%.....&.....(.....6.....C.....W.....h....................... ...........6.....}...........0.................$.................S.....m...........f.................$.......................w...........%.....J...........] ..... ..... ....5!.....!.....!.....!....j".....".....#.....#.....#....F$.....$.....$....7%.....%.....&....3&.....&.....'....<'....W'.....'....:(....j(....|(.....(....h).....).....)....(*.....*.....*.....*....m+.....+....',....6,.....,....4-....o-.....-............................6/...../...../...../.....0....%1....x1.....1.....2....|2.....2.....2....W3.....3.....4....<4.....4.....5....d5....|5.....6.....6.....6.....6....l7.....7.....7.....8.....8....19....s9.....9....$:.....:.....:.....;.....;....T<.....<.....<....G=.....=.....>....)>.....>....[?.....?.....?.....@....r@.....@.....@....+A.....A.....A

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\lv.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):643309
                                                                                                                                                                                                                Entropy (8bit):5.637177021245093
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:Uz9waCt7x2/28mvsf4xN3tVF89voxEJiiUh/7bOEw5hp1UrFeTE/CoCKbnh2Degl:UFuKvNMEGFOEw5WFeTunbf35S
                                                                                                                                                                                                                MD5:00B517CE675A3089823708776C6F9302
                                                                                                                                                                                                                SHA1:2BC24F150ADAAFD2604C5D95BBAAF8DC983D7DA2
                                                                                                                                                                                                                SHA-256:0ADEDD1EAAF902FEEBB208220D9F21AE1B0175E74F6A966CD7ED226146D86AE8
                                                                                                                                                                                                                SHA-512:6C19A0D779185141FB050369F9FBFE60D0B838E55E2674E3F14A67E1A6970727E329656E458CA8516A41C97B20E67EB1789587AF957129B3D32C94A3536AB12E
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.2...w.^...y.....z.....|.....}.......4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....j.....}.......................\...........k...................................\...........R.....o.............................:.......................j...........2.....D...........4.....f...........% ..... .....!....A!.....!....B".....".....".....#.....#.....#.....#...._$.....$....E%....b%.....%.....&.....&.....'....X'.....'.....'.....(....b(.....(.....(.....)....n).....).....*.....*.....*....0+....u+.....+.....+....p,.....,.....,.....-.....-.....-.....-....N............/...../...../.....0....G0....X0.....0.....1.....1.....1....K2.....2.....2.....2....`3.....3.....4....=4.....4.....5....15....@5.....5...._6.....6.....6....:7.....7.....7.....7....b8.....8.....9....39.....9....1:....u:.....:....+;.....;....P<....c<.....<....f=.....=.....=....5>.....>.....>.....?....o?.....?.....?.....@.....@....-A....qA

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\ml.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1481376
                                                                                                                                                                                                                Entropy (8bit):4.274098791777635
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:gtUOGVx75aWEyghv479y6DPnXKfhBP1zXnxooG98MF3e7hDK5V6jX9fb3VV:gtuxmGKfhBP1zX23F3ek5V6jX9D3j
                                                                                                                                                                                                                MD5:D32A29A61E8AFABA6B42D236257D9929
                                                                                                                                                                                                                SHA1:9664F50EA7590A47C2EB8EB4A3E49BE556D08F7A
                                                                                                                                                                                                                SHA-256:A59FD15C969EE8FFD7E72F5A2245C6A5A4FC048F7899FCA489D78C8F6394CA1E
                                                                                                                                                                                                                SHA-512:2668976853B26B22859F8C20AFAEB4D641845E94779B8994B49F240302420279E3F9A99666B8F551495B7D5A8C3C83609B7ECF276FABD8345CC8C787319EA3D2
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.@...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.&...w.R...y.y...z.....|.....}.......(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....a.......................j...........<.....+.....x.................B.................] ....L!.....!.....".....#....h$.....$.....%....Y&.....&.....'.....'.....(....t).....).....*....n+.....+....4,.....-..........X/...../.....0.....1....W2.....2.....3.....4.... 5....d5.....6.....7....o8.....8....I:.....;.....<.....<.....=....U>.....>.....>.....?....g@.....@.....@.....A.....B.....B.....C.....C.....D....AE....uE....YF.....F....pG.....G.....H....YI.....I.....J.....J.....K....BL.....L....NM.....N.....N.....N.....O.....P.....Q.....Q.....R.....S.....T....DT.....U.....U.....U....?V.....W.....W.....X.....X.....Y.....Z.....[.....[.....\.....].....^....E^....g_....^`.....`....?a....~b....@c.....c....>d....le.....f....dg.....g.....h.....i.....j.....j.....l.....m.....m.....n.....n.....o....Pp.....p.....q.....r.....s

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\mr.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1222173
                                                                                                                                                                                                                Entropy (8bit):4.300698800250203
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:gOG1c9CX6VI4KBYmiMpvVL8lownlWGrInbizwF/yGRu3RxYR3GodgEWYJrOznupW:fG0m4lwcasmKZKbzNvfq1E5imHReZ
                                                                                                                                                                                                                MD5:0E5B29B6AE74A1F94CA4F880F131A79F
                                                                                                                                                                                                                SHA1:6AC5089ACE05847480D2AEEC89954124CAA781AA
                                                                                                                                                                                                                SHA-256:25BF8E86F7C9E88F68D4C40C4F124C16F60DAF22E7A87F55BA2C560A0F640BC9
                                                                                                                                                                                                                SHA-512:30717C0AEF4458BBCF7472316727981829EDADA8BE3003AFD9D65CB01D4CF309F601B1C41539343D6239CB2E9157554C95CF966A4156458A2FD78D2464075C98
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:........q(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.C...t.Z...v.....w.....y.....z.....|.7...}.h...................................................................................-.....z.....................................................R...........U............ .....!....6"....b"....5#.....#....P$.....$....^%....-&.....&.....&.....'.....(.....)....T).....*.....,.....,....5-....S.....V/...../....$0....K1....K2.....2.....3....C4....a5.....6....J6.....7.....8.....9.....:.....;.....;....9<....s<....6=.....=....+>....W>.....?.....?.....?.....@.....A.....A....\B.....B....|C....RD.....D.....D.....E....uF.....F.....F.....G....uH.....H.....H.....I.....J.....J.....K....RL....{M....=N....|N....;O.....O....4P....]P.....P.....Q.....Q.....Q.....R.....S.....T....+T....TU....OV.....V....eW....OX.....Y....mY.....Y.....Z.....[....k\.....\.....].....^....n_....._.....`....Qb....:c....ac.....d.....e...._f.....f.....g.....h.....i....]i.....j.....j....Wk.....k.....l.....m....!n

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\ms.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):554824
                                                                                                                                                                                                                Entropy (8bit):5.250627975386066
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:1fZuPdEaPHdoDKUaxe+2cgFRlWWNxTUcWR95bxlqyGkuBm9ch:xg9HEsxd2hlWEG95vFG3
                                                                                                                                                                                                                MD5:6149507C3AA99C4012D9D7CFE4BC30C8
                                                                                                                                                                                                                SHA1:51A2BB5CBAE64F3877AFC342EA0F43915702F8F4
                                                                                                                                                                                                                SHA-256:DD75481D67D9BE36ECB2E421117395FBB75B7623164F13A09BE1CF3CE76D588F
                                                                                                                                                                                                                SHA-512:71F8DC03618D46BE7B036353526BF20A61E648EF50ADEEEC057D314E9A4536899C37EF691164BF9DE9E10A3867749F8D3D6F4038E16C82CF6122E7AB4A1C7732
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.^...h.f...i.n...j.z...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.;...w.g...y.....z.....|.....}.......=.....B.....J.....R.....Z.....a.....h.....o.....p.....q.....v.............................d...........4.....O.................B.....R...........0.....q.................^.......................f.......................[.......................`................./.......................P.......................- ..... ..... ..... .....!....y!.....!.....!....8".....".....#.....#...._#.....#.....#.....#....!$....t$.....$.....$.....$....G%....n%....z%.....%....A&....{&.....&.....&....I'....~'.....'.....'....?(....q(....{(.....(....-)....])....f).....).... *....S*....^*.....*....A+.....+.....+.....+....B,....g,.....,.....,...."-....F-....`-.....-.....-....(.....9................../....@/...../...../...../...../....U0.....0.....0.....0....e1.....1.....1.....2.....2.....3...._3....m3.....3....<4....w4.....4.....4....I5....w5.....5.....5.....6....;6....K6.....6.....6....&7

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\nb.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):537830
                                                                                                                                                                                                                Entropy (8bit):5.4264919827777245
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:GFxHxFb73kroOp7fBpHXYbhOs5wk+bhPLgg5t:GXxFXkJ1YbhOs5f+bFUG
                                                                                                                                                                                                                MD5:2A0EC73D03D4D7FCEC71AD66CC0D4B30
                                                                                                                                                                                                                SHA1:BB8DF6E11B02086726ECEDE97D5F729F4197323C
                                                                                                                                                                                                                SHA-256:D44EF5E644B1B8F7C056D5E20651515FCC8565BEFEC575091735FB39C6D63554
                                                                                                                                                                                                                SHA-512:CDCB4E436270156E263D731CE243D821C5361B18B6D7B8259875C9D895301D478A87FEB7CAFC3376D09D18D27F32DC403FD2CBD034D68736CB968BBEFEBD642B
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h. ...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.0...y.W...z.....|.....}...............................#.....*.....1.....8.....9.....:.....<.....G.....V.....i..................................._...................................n.................P.......................M.....w.................:.....c.....r...........B.....r.................w.................`...........- ....L ..... ....&!....^!....r!.....!....r"....."....."....m#.....#....J$....l$.....$.....%.....%....'%....}%.....%.....%.....&....`&.....&.....&.....&....I'.....'.....'.....(...._(.....(.....(.....(....a).....).....).....*...._*.....*.....*.....*....Q+.....+.....+.....+....`,.....,.....-....5-.....-.....-................x................../....[/...../...../...../....b0.....0.....1....F1.....1.....1.... 2....92.....2.....3....23....J3.....3.....4....J4....^4.....4....95....u5.....5.....6.....6.....6.....7....o7.....7.....7.....8....Y8.....8.....8.....8....<9.....9.....9

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\nl.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):556268
                                                                                                                                                                                                                Entropy (8bit):5.362124110769206
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:jVAWY0lbJ9WQusFUiFgN5tmDdx5btfKzaWDZqqn9pmTy:qWY0lbJ9WQusFU15tmDdx5bFKzaWVqq1
                                                                                                                                                                                                                MD5:E8B790166D701F63A60C3B322FCCE234
                                                                                                                                                                                                                SHA1:61EC318AA8030F7D29C3258126B156D1D3EEFA2C
                                                                                                                                                                                                                SHA-256:3D73B0110E5832B6A7C7B7E64018368464EF8552D6A98592D0ADBF713EB9755E
                                                                                                                                                                                                                SHA-512:4E4B299CB55CBB5906FF974BB5E5078D2018298B5EE6D9CA0E40AAB8DB542AAEDC4BD7A5DB242A2C5194BC90C07631F627043DCC1A9F2D095A28C3E35F212DD9
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.....j.....k."...l.-...n.5...o.:...p.G...q.M...r.Y...s.....t.....v.....w.....y.'...z.U...|.|...}...............................................................................(.....9.....K...........m.................W.......................{...........3.....I.................L.....c.................7.....F.......................(.................7.....X...........0.....g.................E.....z.................T ..... ..... .....!.....!.....!.....!....[".....".....#....3#.....#.....#.....#.....$....X$.....$.....$.....$....,%....}%.....%.....%.....&....|&.....&.....&.....'....u'.....'.....'.....(....U(.....(.....(.....(....4)....`)....m).....)....)*....]*....l*.....*....H+.....+.....+.....,....W,.....,.....,.....,....=-....^-....u-.....-....+.....S.....e...........7/....n/...../...../....<0....Z0....n0.....0....21....d1....u1.....1....G2.....2.....2....-3.....3.....4.....4.....4.....5....D5....i5.....5....46....e6....z6.....6.....7....A7....Q7.....7.....8....A8

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\pl.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):619265
                                                                                                                                                                                                                Entropy (8bit):5.770526396702215
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:zifPIC1WoOB/ktv/XfQfuzSJY9HQbyDPSCUd4e3m7UyMgmx1QhH1b5FuH4VZy:YTxbMJ1Qh15w
                                                                                                                                                                                                                MD5:8A4354163FF3B0978A568F781BDAC289
                                                                                                                                                                                                                SHA1:45DE421F35AF79ADF962809CF8D0E6D2ADBCB553
                                                                                                                                                                                                                SHA-256:2F6DE0F9A46AE0B75BEB67E09FFEEE12483842A7CD6F2A2382CCBE36FBFC17E3
                                                                                                                                                                                                                SHA-512:5760F20228AFE74E9FF2A916A168E8CC2D4A64D8E76065E61A7A60616A473C7DC3DA4805125B270F179B7A0F291071E81D761D82EEC3B130D552B57ABD76C127
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i./...j.9...k.H...l.S...n.[...o.`...p.m...q.s...r.....s.....t.....v.....w.&...y.M...z.{...|.....}..................................... .....'.........../.....0.....2.....A.....O.....d.....y.........................................%.....8...........M.......................u................./.......................(.......................I...................................I.....n...........8 ....p ..... ..... ....M!.....!.....!.....".....".....".....".....#.....$....d$.....$.....$....$%....9%....Z%.....%.....%.....&....&&....o&.....&.....&.....&....O'.....'.....'.....'....](.....(.....(.....(....Y).....).....).....)....J*.....*.....*.....*....:+.....+.....+.....+....Q,.....,.....-....+-....y-.....-.....-.....-....Y.......................E/...../...../...../....g0.....0.....1....@1.....1.....1.....1.....2....s2.....2.....2.....3.....3.....3....+4....E4.....4....85.....5.....5....%6.....6.....6.....7....c7.....7.....7.....7....@8.....8.....8.....8....$9.....9.....9

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\pt-BR.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):581655
                                                                                                                                                                                                                Entropy (8bit):5.426534241883623
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:mHM4QhMCJi4wNNBXBLGfs9y+z5GHNXun0msRgMpI2:CchHi4wD50XosR9pN
                                                                                                                                                                                                                MD5:B1AB7D7AA67A7B61BFA9AEBAD0B812AF
                                                                                                                                                                                                                SHA1:95EFF4BE517C0A25C34578DEF10D48C77021DE1A
                                                                                                                                                                                                                SHA-256:5BD503C413AAF8FA87FD47C341D437ACCC25397A50B082068BCF2F3BB4FB27C7
                                                                                                                                                                                                                SHA-512:8498FE7727771DF3C1EB34560C1E25B0C30690C7C921104B4ADCF04CC5753462BAC513A60A5833CB6F57733201D4883605F8A4EC4A457F3EBC7C952090B1A9E1
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.-...j.9...k.H...l.S...n.[...o.`...p.m...q.s...r.....s.....t.....v.....w.&...y.M...z.{...|.....}..................................... .....'.........../.....0.....5.....G.....W.....y.............................%.................%.....5...........R.................4.......................6.............................r.................G.................'.................d................._ ..... ..... .....!....}!.....!.....!....J".....".....#....!#.....#....-$.....$.....$.....$....>%....d%....w%.....%.....&....d&....s&.....&....+'....`'....n'.....'....4(....o(.....(.....(....-)....^)....j).....).....*....:*....D*.....*.....*.....+.....+....}+.....+.....,....$,.....,.....-....q-.....-.....-....'.....K.....`................../....y/...../...../.....0.....0.....1....F1.....1.....1.....2....-2.....2.....2.....2.....3.....3.....3....(4....D4.....4....D5.....5.....5....A6.....6.....6....'7.....7.....7.....8.....8....e8.....8.....8.....8....`9.....9.....:....!:.....:

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\pt-PT.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):585544
                                                                                                                                                                                                                Entropy (8bit):5.398721361990628
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:EdZCITRW+kQdJs7ieJVJJxhbHMm5wfBCV5z6jPdoSR7oF:6XJksvMV5+jPSSR7Y
                                                                                                                                                                                                                MD5:CBE5E35F844F5F1400DF3685CC847694
                                                                                                                                                                                                                SHA1:E60CDB0A813A97C8548C878276BFAE155350BB42
                                                                                                                                                                                                                SHA-256:6B9BD714D217D596183894FFED3174A617E1C8CFAE292231D4B967183B589C6B
                                                                                                                                                                                                                SHA-512:96046C97436A3DBF5AAC479B9EAA9DFDCFC81F1EDCAEE9CD65D59BEB0CE6B6B42828E0D170AAEF2EF1D68988F7916AC1DBAC0D84218DE83FEDCCA8592DE4C1F1
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.X...h.`...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.>...w.j...y.....z.....|.....}.......@.....E.....M.....U.....].....d.....k.....r.....s.....t.....y.............................U...........=.....Z...........%.....p...............................................8.....\.................).....9.........................................O.....}...........].................- ..... ..... ..... ....L!.....!.....!....."....i".....".....#....3#.....#....)$.....$.....$.....$....U%.....%.....%.....%....C&....t&.....&.....&....F'.....'.....'.....'....V(.....(.....(.....(....W).....).....).....)....:*....g*....q*.....*.....+....@+....J+.....+.....,....5,....F,.....,....$-....t-.....-.....-....4.....^.....z................../....$/...../...../.....0..../0.....0.....1....U1.....1.....1.....2....H2....Z2.....2.....3....>3....S3.....3.....4....b4....|4.....5.....5.....5.....5....u6.....6....,7....P7.....7....38....s8.....8.....8....'9....L9....a9.....9..../:....k:

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\ro.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):606335
                                                                                                                                                                                                                Entropy (8bit):5.4540537912984615
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:kxrPkiHXWrfGENd49ow6q0gdKXKkQGXq5e3jUZGs2hj/Xrbf:CrxXWr3Nu9o7qHKasq5ezUuj/3f
                                                                                                                                                                                                                MD5:5DB10EDF772656C0808DD8DA698334BF
                                                                                                                                                                                                                SHA1:3CAF7C9D5A3B44E06E0588DABA698B6970EA06F5
                                                                                                                                                                                                                SHA-256:73B6A63352906D77196F38A1DF937EC0770160FB7A93321867C7994ED3E7967B
                                                                                                                                                                                                                SHA-512:EB253B548C7F574943136764A23818F9DEDEA17FF42F92DC8591F4B7C297ACCDDE9F6B2C0AD96F1FD0815C53940C0102A90C603F9F4D6D9C8FB053B559CC7A62
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.!...j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.?...z.m...|.....}................................................. .....!.....".....$.....3.....?.....M....._...........w.................P...................................T.....s...........\.......................g.......................C.....l.................a.................N................."............ ....H ....a ..... ....$!....X!....m!.....!....C"....."....."....0#.....#.....$.....$.....$.....$.....$.....%....W%.....%.....%.....%....(&....u&.....&.....&.....'....e'.....'.....'.....(...._(.....(.....(.....(....G)....q).....).....).....*....C*....S*.....*.....+....4+....H+.....+....@,.....,.....,.....,....G-....f-....|-.....-..........7.....[............/....K/....^/...../....O0.....0.....0....&1....i1.....1.....1.....2....x2.....2.....2....B3.....3.....3.....3....g4.....4....95....R5.....5....C6.....6.....6....&7.....7.....7.....7....*8....t8.....8.....8....,9.....9.....9

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\ru.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):996315
                                                                                                                                                                                                                Entropy (8bit):4.845331047532895
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:4I6pfQjRo4YSWPAY+zJ9LF1WAati/16HzW/yqSvDsNL4kXew+YHVeXN2hVO3j/iH:4T25H3Oc
                                                                                                                                                                                                                MD5:E9AF20A6226511CD535888846A2BB16F
                                                                                                                                                                                                                SHA1:739A46269F334ECC291BAE6777F0B7C8E271E4C0
                                                                                                                                                                                                                SHA-256:5DB640C6C288D9FC79012A7670301A3BC463359C17BA200AEDAA56260EF8D955
                                                                                                                                                                                                                SHA-512:7897C500718382F08D55F3CDDD96D1451524B5C2B8FEBC65E1700A645598B622C819EC66E4A21C119F044FAAA525A2ABDDDF66D0C9800AF6ECEA9CEB217A88BB
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(d.e.....h.....i.....j.....k.....l.....n.....o.....p.%...q.+...r.7...s.f...t.}...v.....w.....y.....z.3...|.Z...}...............................................................................$.....<.....c.....X.....$...............................................D.............................G...........0...........8.....[.................Q.....h...... ..... .....!....J!....=".....#.....#.....#....z$.....%...._%.....%....;&.....&.....'....A'.....'.....(....#)....P)....T*....N+.....+.....,.....,....0-....]-.....-............................_/...../...../.....0.....0.....1....X1....}1....#2.....2.....2...."3.....3....%4....`4....w4.....4....t5.....5.....5....B6.....6.....6.....7.....8.....8...._9.....9.....:.....:.....:.....:....T;.....;.....;.....;....|<.....=.....=.....=.....>.....?.....?.....?....|@.....@.....A.....A.....A....GB.....B.....B.....C.....C....mD.....D....jE...."F.....F.....F.....G.....H.....I....lI.....J.....J.....J.....J....xK.....K....&L....?L.....M.....M....4N

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\sk.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):626605
                                                                                                                                                                                                                Entropy (8bit):5.815043408006658
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:6fKTvoktDh40i/igVQm5611wYZLtWTjsxt9Wl:6KTdjib5ewsPtIl
                                                                                                                                                                                                                MD5:B0BBB6661370D27B6600EBE98CADB9AC
                                                                                                                                                                                                                SHA1:1139852DA47048F15C16EB101DAC86DFC8F652BA
                                                                                                                                                                                                                SHA-256:E0FE4130E668AC659D5334C5BC8CDE70BBA8742273B5965836860B5A8B1B016A
                                                                                                                                                                                                                SHA-512:C8EAC323552F873EC088F77B8C46522387B0298B6D566CF8AA173FA9B2D66389068BB26E46044AF2FAA4224B39DC748164843B58B99E9DDE093FCB32AFB5FED0
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.....j.:...k.I...l.T...n.\...o.a...p.n...q.t...r.....s.....t.....v.....w.'...y.N...z.|...|.....}.....................................!.....(...../.....0.....1.....3.....G.....O.....a.....v.....2...........N.....l...........M.................'.........................................6.................4.....G.................).....=.................K.....p.............................z ..... ....,!....E!.....!....("....^"....o"....."....v#.....#.....#....d$.....$....B%....]%.....%.....&....3&....H&.....&.....'..../'....A'.....'.....(....)(....;(.....(.....)....Y)....o).....)....L*.....*.....*.....*....X+.....+.....+.....+....u,.....,.....,.....-.....-.....-.....-....s...........D/....\/...../...../.....0....+0.....0.....0.....0.....1.....1.....1.....2....#2.....2.... 3....e3.....3.....3....C4...._4....t4.....4....R5....y5.....5.....6.....6.....6.....6.....7.....8.....8.....8.....9.....9.....9.....9....O:.....:.....:.....:....L;.....;.....;.....;...._<.....<.....=

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\sl.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):601837
                                                                                                                                                                                                                Entropy (8bit):5.489524001909229
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:mZ9VfcB2z/i1SE5vqfCWJU171i/fzSjqc:mHVBWSE5vqfmi/fzSl
                                                                                                                                                                                                                MD5:AA7C0F35B61A230D65E498DAAB67388C
                                                                                                                                                                                                                SHA1:F60CB1C7128A1FB1CFD9AA029F96DF36033777D0
                                                                                                                                                                                                                SHA-256:03AFC83CDBA98C08AF169C8AE111AA916F3EE6D5A2FEE4954EF35ECC063F2B21
                                                                                                                                                                                                                SHA-512:048D03C490F18D22F4900363F9C4ABEE037A2029F226C90806064FFEDC85B07A1D86225B9C534311B08F588632A84221D7E4FA355E7B768CFDFD6102C5FFE705
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.....j.....k."...l.-...n.5...o.:...p.G...q.M...r.Y...s.....t.....v.....w.....y.'...z.U...|.|...}...............................................................................,.....<.....O...........n.................J...................................N.....m...........9.....m.................8.....c.....p...........+.....V.....e...........G.....|........... .......................]............ ..... ..... ..... ....%!....9!.....!....3"....j"....."....$#.....#.....#.....$....v$.....$.....$.....$....T%.....%.....%.....%....?&.....&.....&.....&....K'.....'.....'.....(....n(.....(.....).....).....).....)....;*....P*.....*.....+....:+....M+.....+.....,....B,....Q,.....,....,-....i-.....-.....-....8.....X.....p............/....;/....V/...../.....0....\0....n0.....0....O1.....1.....1.....2....l2.....2.....2.....3....x3.....3.....3....34.....4.....4.....4.....5..../6.....6.....6....j7.....7....@8....}8.....8....T9.....9.....9.....9....;:....Y:....i:.....:....I;.....;

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\sr.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):924863
                                                                                                                                                                                                                Entropy (8bit):4.7696519516761695
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:nP3ydDCzsexx7UinNLQIlApSld7vwFi4CBaAwH5YvTEquCxa4F37nyIzy/k/S:P3G2zBTfWt5suBr
                                                                                                                                                                                                                MD5:ABDD9EB966D915C1896B31CBA0B2656B
                                                                                                                                                                                                                SHA1:CB0080E5F2C168CD0F3EDC6ED6C47734FFD67790
                                                                                                                                                                                                                SHA-256:3913D3BE5016CE873AC68AF376D5FCF558BB5F5F29A9BC56DF0099BA47E52486
                                                                                                                                                                                                                SHA-512:BCB258D6DA766BB6F00DFDBB03BC878000D9CF28B2B707375CE52485DB9C530A34D1528A1473F09B5765BC57ABD847F191BDE55646EB707443CD0E40509B70E1
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e. ...h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...q.....r.....s.....t.....v.....w.2...y.Y...z.....|.....}...............................%.....,.....3.....:.....;.....<.....>.....h................................... .....R.................#.....F.....A.............................M.......................) ....| ..... ....(!.....!.....!.....!....."....b#.....#.....#.....$.....%....=&.....&....C'.....'....B(....k(....').....).... *....E*....++.....+....b,.....,.....-....y....../....V/...../....V0.....0.....0....B1.....1.....1.....2.....2.....3....G3....f3....*4.....4....+5....V5.....5.....6.....6.....6.....7.....8....Q8....l8.....9.....9.....9.....9.....:.....;....n;.....;....[<.....=.....=.....=....E>.....>.....>.....?.....?....%@....^@.....@....EA.....A....$B....AB.....C.....C.....D....\D.....D....eE.....E.....E.....F.....G....lG.....G....xH.....H....yI.....I.....J....fK.....K.....L.....M.....M....!N....kN....%O.....O.....P....%P.....P.... Q....XQ....uQ....FR.....R....[S

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\sv.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):541025
                                                                                                                                                                                                                Entropy (8bit):5.5401177610527155
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:MnZyPzw0uHrwiTR91Q0Z4IoogVChcxorsl6hI+vRFcz5RtGl2KYF4bkvMrOSOgfm:i8U7DTC0Z4KhJW5krMTMo
                                                                                                                                                                                                                MD5:CC0806219798E3ADE0437219457A37AB
                                                                                                                                                                                                                SHA1:DD6BA47E14B7B0D08159FBCA2409B013DC2E17DE
                                                                                                                                                                                                                SHA-256:79A7260C8651FF3024E21F9263543BF4E9D5F3574E81CF96EDF6388F8DA85CD1
                                                                                                                                                                                                                SHA-512:DF3DA02BB2FECBBAF1AB80AF8EF8B1A7AE9F6C7ED01F94C5A502720376924132C344DD716FC5B4DDC03733A6C3581ED8D8A577154C619BA85C527DC67F4A48C2
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:........p(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.8...t.O...v.....w.....y.....z.....|.,...}.]...........................................................................................................Y.....o...........B.........................................e.......................r.......................r...................................1.....Q...........?.......................].................. ....x ..... ..... ....E!.....!....."....#"....."....N#.....#.....#.....$....n$.....$.....$.....$....O%....t%.....%.....%....-&....S&....b&.....&....2'....i'....{'.....'....6(....d(....s(.....(....()....S)....b).....).....*....C*....S*.....*.....+....H+....W+.....+....*,....e,....z,.....,....%-....E-....^-.....-.....-..........1.....}.......................u/...../.....0....D0.....0.....0.....1....-1.....1.....1.....2....&2.....2.....2.....3....03.....3....44.....4.....4.....5.....5.....5.....5....W6.....6.....6.....6....F7.....7.....7.....7.....8.....8.....8

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\sw.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):570564
                                                                                                                                                                                                                Entropy (8bit):5.341574755821131
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:Evzozr9Cpdjcu25KmedqrCBfRdpG5PbQW49qx2FRyl+Y4jNUkCarOg6jP5AuNskZ:Evk3v15zsI
                                                                                                                                                                                                                MD5:A63EF2C4676DFBEE98E29A84A7AD9D27
                                                                                                                                                                                                                SHA1:2F0F4B33ACF5E63F3159C62C74DEAA9A361203F4
                                                                                                                                                                                                                SHA-256:7B8C51B247DEA72D68CB0EF4292800C13209DA6F859A9AD289C996582F19E65C
                                                                                                                                                                                                                SHA-512:CD65FD2C49D35757DE648F21DEC748FB4A1D13D2308552774FE9C859AD5748B21F5DB449F8B380520F27DC868A3EBAAFD58D4C45ABA34033785777D342E17E6F
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.!...j.-...k.<...l.G...n.O...o.T...p.a...q.g...r.s...s.....t.....v.....w.....y.A...z.o...|.....}.................................................".....#.....$.....).....;.....K....._.....v.............................U...................................L.....b.................I.....].................2.....A.......................).................*.....P...........N.................%.......................3 ..... ..... ..... ....4!.....!.....!.....!....q"....."....J#....f#.....#.....$....8$....S$.....$.....$.....%.....%....Z%.....%.....%.....%....L&.....&.....'.....'....m'.....'.....'.....(....n(.....(.....).....)....l).....).....).....)....X*.....*.....*.....*....q+.....+....",....;,.....,.....,.....-....6-.....-.....-....).....J............/....F/....V/...../....20....{0.....0.....1....N1....o1.....1.....1....02....X2....j2.....2....F3.....3.....3....04.....4.....5.....5.....5.....5....>6....[6.....6....P7.....7.....7.....8....j8.....8.....8....89.....9.....9

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\ta.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1468553
                                                                                                                                                                                                                Entropy (8bit):4.052663401346278
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:eO7hLhGq5MLs32+5CrVKa1i55G62sRtRdutm1vYpiMy+:rdLhGoC+sBD1i554sRtRdutm1vYpiMy+
                                                                                                                                                                                                                MD5:AA06EAD1200F01C9460399F0ABE2D54F
                                                                                                                                                                                                                SHA1:9B852C4691209C0AE9EDF94A5DEC4B902FEC7B3E
                                                                                                                                                                                                                SHA-256:1946D903918C57836D2F898EF93CD1D575DA1A464E358C399DFDE73EA2EF057E
                                                                                                                                                                                                                SHA-512:6E556B962C16AEE22695D93B62B308D95B0695873FB33D13A147B3D8B6791C9599DAA6E3BF424A1897212A018AB36DD8C8214C2EB03457048C6931686BE40E04
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.F...t.]...v.....w.....y.....z.....|.:...}.k.............................................................................).....i...........e...........G.....y.............................}...... .....!.....!....D#....z$.....%....H%....I&....<'.....'.....'.....(.....).....*..../*....g+....k,.....,....V-...........0.....0....21....S2....i3.....4....O4.....5.....6....[7.....7.....8....5:.....;....d;.....<.... >.....?....m?....p@....9A.....A.....A.....B.....C.....D....<D....$E.....E....ZF.....F.....G.....H....UI.....I.....J.....K.....L....<L....*M.....N.....N.....N.....O.....P.....Q....KQ....ER....6S.....S.....S....>U.....V....kW.....W.....X.....Y.....Z....CZ....&[.....[....J\.....\....p]....Y^....$_....q_.....`.....a....+b.....b.....c....Nd.....d.....d.....f...."g.....g.....h.....i.....j....tk.....k.....m.....o.....q....Pq.....r.....s....nt.....t....Nv....tw....$x.....x.....y....vz.....z....6{....h|.....}....5~

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\te.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1359248
                                                                                                                                                                                                                Entropy (8bit):4.307321925100967
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:RG0y8Y7McKNW0yR5D7FgpC8ybtKRT5sbvkW3p/8WffhBp3p1FPnzTitlF2iDk7Pi:RGB+s5RNHFy
                                                                                                                                                                                                                MD5:A4ACCC25DD8A00BC57DF4FCA12E41295
                                                                                                                                                                                                                SHA1:9466888034C9E6ECF4113DDDA63D363ED20E3156
                                                                                                                                                                                                                SHA-256:157D646525F6A9AC267466631671E65E9B5C3E55B008B564186E64C6853E52AA
                                                                                                                                                                                                                SHA-512:F19116655B6C2BB5C572B45F1D712FA1F9D57D9E8963FB3D654ED3781BD34A4E937B590BCC1119A318E28632DA12A0EF8B36F6426791DE833898CF7F30189567
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.:...h.B...i.\...j.h...k.w...l.....n.....o.....p.....q.....r.....s.....t.....v.)...w.U...y.|...z.....|.....}.......+.....0.....8.....@.....H.....O.....V.....].....^....._.....d.......................^.......................D.................".....q............ ..... ....6!....s".....#....+$....f$....H%.....%....D&....y&.....'....X(.....(.....)....'*.....*....l+.....+....O-....y.....E/...../.....0.....1....e2.....2.....3.....4....i5.....5.....7....C8....A9....~9.....:....d<....D=.....=.....>....:?.....?.....?.....@.....A.....B....]B....qC....6D.....D.....D....3F.....G.....G.....H....5I.....J.....J.....J.....K.....L....>M.....M.....N....nO.....O....%P....KQ.....R.....R.....R....8T.....U.....U.....V.....W.....W.....X....`X....+Y.....Y.....Y....,Z.....Z.....[....h\.....\.....].....^....._....#`....$a.....a....4b.....b.....c.....d....#e....pe.....f....sg.....h....Vh....(j.....k.....l....!m.....n.....o....op.....p....6r....#s.....s.....t.....u.....u....?v.....v.....w.....x.....y

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\th.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1142703
                                                                                                                                                                                                                Entropy (8bit):4.350453098899463
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:X6cnN9LyZYAPTKznL/4svUSynUGevuB5Uz0dNL3fRj8NRU+wunRUdGILV+w11LAn:X05ANf
                                                                                                                                                                                                                MD5:B18E4574DB917920ECCFB8E6900D0662
                                                                                                                                                                                                                SHA1:554206B9E639135074B0946FB28B6FFE2D934159
                                                                                                                                                                                                                SHA-256:C14FA1BB30C880216D6CFEA6FB738235CF72A3FE8BE919C3D61321D5A5883211
                                                                                                                                                                                                                SHA-512:5F427F9ED85BB368B45BAFD523C634E18596E430FDC380563878D2CA897CF2580D0405F7C0D8E10ABBA389BB7125978A81D335263BB777E0EE0BFE3D47C8C65F
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........'..e.8...h.@...i.H...j.S...k.b...l.h...o.p...p.}...q.....r.....s.....t.....v.....w.6...y.]...z.....|.....}.........................$.....,.....1.....9.....@.....G.....N.....P.....U.....y.................<.....M.....$.......................`.............................h.......................]...........P............ ....> ..... ....Z!.....!.....!.....".....#.....$.....$....y%.....&.....&.....&.....'....R(.....(.....(.....)....f*.....*.....*.....+....t,.....,.....-....F.....5/...../....30.....1.....1.....1....82.....3.....3.....4....@4.....5.....5.....5.....6.....6.....7.....8....A8.....9.....9....4:....X:....$;.....;....E<....l<.....=.....=.....>..../>.....?.....?....%@....L@....fA....cB....'C....OC.....D.....D.....D.....E.....E....JF.....F.....F....hG.....G....OH.....H.....I....TJ.....J....ZK.....K....oL.....L.....L.....M....<N.....N.....N.....O....KP.....P.....Q.....R.....R.....S.....S.....U.....V.....V....$W.....X.....X....HY....xY.....Z.....Z....![....@[....I\.....].....]

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\tr.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):581275
                                                                                                                                                                                                                Entropy (8bit):5.614415854351588
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:A9dM9N/9/UHzNsgkDQqZFtQSJ8kJ5MLJy:0eZb8kJ50Jy
                                                                                                                                                                                                                MD5:82C6A14BA1B28F947BEE67BC3FEAB091
                                                                                                                                                                                                                SHA1:25023B22EAED29D0817EC95D5BCB4AD3D724F5AD
                                                                                                                                                                                                                SHA-256:099507F6F2A2C98ECCE275F8AD956EEEEAADA65B7788356301AF04A0CD7D431E
                                                                                                                                                                                                                SHA-512:988A9275B7A05D100CA9242DD05969D2363A42938D47DB37A1F62EC1874E96B640C14B272F1829AB5C6E0D2763C22FBF0AF99894D4D9D32726925EABBC02C05E
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.-...v.b...w.....y.....z.....|.....}.;.....d.....i.....q.....y...................................................................................k.................K................. .......................Y.......................].......................D.......................N...................................3.....P............ ....G ....X ..... .....!....6!....F!.....!....2"....u".....".....#.....#.....#.....#....D$.....$.....$.....$....D%.....%.....%.....%....A&.....&.....&.....&....A'.....'.....'.....'....T(.....(.....(.....)....b).....).....).....*...._*.....*.....*.....*....\+.....+.....+.....+.....,.....-....R-....k-.....-....1.....^.....z...........$/....F/....a/...../.....0....C0....U0.....0....,1....f1.....1.....1....52....T2....d2.....2....(3....S3....h3.....3....<4.....4.....4....C5.....5....[6....m6.....6....r7.....7.....7....o8.....8....)9....E9.....9.....:....9:....N:.....:....';....`;

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\uk.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):996487
                                                                                                                                                                                                                Entropy (8bit):4.873979205850633
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:1x/vKIH9mGGHWK9TddsSr+whF5gZrZEdIIXgOb5YB3Ijwl2Ab+rUcauHLNiXErqx:3/vXH9ynh5BrI
                                                                                                                                                                                                                MD5:EC3AA18A9D9C989B1025DDDB0FA52B55
                                                                                                                                                                                                                SHA1:AB3B0834CABEE34BC2F9FD04104B10E5F9C102CA
                                                                                                                                                                                                                SHA-256:EE67744C26E0C69FBED8B102ADD339070AABC70C2D8CA9EA037C6C9D23B66D3B
                                                                                                                                                                                                                SHA-512:90D40424B050C6C7ACE113E85B0B0A58472967C50A14FBC6637CD3B2DB8FF3F521CC94DCD256FA017684256E8A9C19B158AAA57F6D3094FAB970578D3B1C6847
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:........[(..e.t...h.|...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.Z...w.....y.....z.....|.....}.3.....\.....a.....i.....q.....y...........................................................7....."...........x...........\...........b...........W.............................&.................q...........X.....}...... ..... .....!.....!.....!....f".....".....".....#.....$....'%....c%.....&.....&.....'....5'.....'....t(.....(.....(.....)....a*.....*.....*.....+.....,....8-....r-..........k.................\/...../.....0....90.....0....81....v1.....1....H2.....2....F3....m3.....4.....4.....4.....4.....5.....6....R6....k6.....6....z7.....7.....7....n8.....8....<9....W9....P:.... ;.....;.....;....}<.....<....A=....c=.....=....9>....b>.....>....5?.....?....T@....o@....dA.....B.....B.....C.....C.....D....<D....iD.....E.....E.....E.....F.....F....]G.....G.....H.....H.....I....hJ.....J....wK....;L.....L.....M.....M....DN.....N.....N....EO.....O.....P.....P.....P.....Q.....R

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\ur.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):870809
                                                                                                                                                                                                                Entropy (8bit):5.161712117251234
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:wtiyilnG/Uo458PMzCR4FXdQLN9AyTibR45GO6EhTCWORJlbQYrMYVwadcJKwURn:Vyie5T5/Cgu
                                                                                                                                                                                                                MD5:CB228CC41981E8BCBD2768DA20026912
                                                                                                                                                                                                                SHA1:C55BB999C4C1FBEE5E38B6C986FBCE2B128F3880
                                                                                                                                                                                                                SHA-256:A7D825FE348700528800EF9EA7940EE8027373E9C05A4E51E526D0A213C05429
                                                                                                                                                                                                                SHA-512:85308806BE53494683F32520E181DD9C8C9ABAC0B92BC439D4E30EEF22D4AF993794A9719DD9A4EEED0BBCAF61C0E2342E7D4ED5D30B504572BD2BC269100E2E
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(..e.....h.....i.....j.....k.!...l.,...n.4...o.9...p.F...q.L...r.X...s.....t.....v.....w.....y.&...z.T...|.{...}.........................................................................&.....@.....^...........Z.......................w.....!.......................G.......................N.................k...........7.....X...........g ..... ..... ....d!.....!....%"....R".....#.....#.....$....Q$.....$.....%.....%.....&.....&....L'.....'.....'.....(....W).....).....*.....*.....+....7,....h,.....,....H-.....-.....-....+.......................q/...../.....0....90.....0....Z1.....1.....1....a2.....2....A3...._3.....3....j4.....4.....4....U5.....5.....6....)6.....6....47.....7.....7....d8.....9.....9.....9....Q:.....:.....;....=;.....;.....<....K<....y<.....=.....=.....=.....=.....>....@?.....?.....?....x@.....@....%A....HA.....A.....B.....B.....B.....C....GD.....D.....D.....E....xF.....F....!G.....H.....H....-I....lI....7J.....J....4K....bK.....K....qL.....L.....L.....M.....N....oN

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\vi.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):689415
                                                                                                                                                                                                                Entropy (8bit):5.7905904014606335
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:v8/9MO+cGZoEK9VaZLlFK0FgxBxJbTsIxvx5a8h/9cDNUOnmzi0HRva8Z1lc:vSSO+cG6V4lE0uxHZH5a899yiOnwi01k
                                                                                                                                                                                                                MD5:045241A62232BAE57F1D57C6C3AF7C55
                                                                                                                                                                                                                SHA1:5C2A1A677A8BDFA20F3577335131BD4B89A46355
                                                                                                                                                                                                                SHA-256:56758C918BBFE6A9D5B20E8B4A7248BDF2D43E0BF5F98E85A9892FF03DBC2D99
                                                                                                                                                                                                                SHA-512:8E30AF44A53A36A194DA16A756DFF0F90EFBEF164277BDCDE683C89A3CDC04AE5E1298475E8A098D19DAB73EB0A71637F676D49D237C5480E1F7ACA1765166BB
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:........P(..e.^...h.f...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.M...w.y...y.....z.....|.....}.&.....O.....T.....\.....d.....l.....s.....z...........................................................O.................r...........G.....^.......................*...........+.....}.................?.....e.....q...........G.................2.............................. .....!.....!.....!....?"....."....."..../#.....#.....#.....$.....$....;%.....%.....%....t&.....'....q'.....'.....(....o(.....(.....(....').....).....).....)....B*.....*.....*.....*.....+.....+....E,....\,.....,....2-....i-....z-.....-....D.....x.................Q/...../...../.....0....v0.....0.....0....r1.....2....x2.....2.....3.....3.....3.....3....V4.....4.....4...._5.....5.....6....+6.....6....h7.....7.....8.....8.....9....89....Z9.....9....W:.....:.....:....N;.....;.....<....+<.....<....s=.....=.....=.....>....Y?.....?.....?....u@.....@.....A....,A.....A.....A....2B....FB.....B....xC.....C.....C

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\zh-CN.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):496499
                                                                                                                                                                                                                Entropy (8bit):6.685741162993645
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:rr0PPN0s9IHFKwowzwAEM7i56Ez2bHy1t59Lo3/4oT2Paq8lc:XGNXUKwTzwx956Ez2bH05Nov4oTUV
                                                                                                                                                                                                                MD5:798BC7D8B63906C5B1C67E89AD17DC58
                                                                                                                                                                                                                SHA1:B39C86D6D3FD9D8B8DA90D86F827A0C0803FBA8C
                                                                                                                                                                                                                SHA-256:1C05280D8DCDFE99619695B76DD054292A90C1A93A5CFB92CDC4A5B0068A7092
                                                                                                                                                                                                                SHA-512:7A21AF438823D562B889D7C99F639421E01F0536E95F3206DD53D2C8DED82B7A4AB74BB9B4262B2FA27E50EFD8DD7719827AD2E6B6D4C2E0D0811930027ED982
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........(U.e.....h.....i.....j.....k.+...l.2...m.:...o.a...p.f...q.l...r.x...s.....t.....v.....w.....|.F...}.w.........................................................................................%...........6.......................U.......................\.......................e.......................d......................./.....V.....c.................6.....P...........+.....l.....~...........:.....n.....{........... .....I.....U.................;.....M..........." ....` ....r ..... .....!.....!....5!.....!.....!.....!.....!....D"....."....."....."....!#.....#.....#.....#....)$....{$.....$.....$.....%....a%.....%.....%.....%....?&....g&....s&.....&.....'....A'....M'.....'....3(....t(.....(.....(....#)....C)....W).....).....)....$*....;*.....*.....*.....+....(+.....+.....+.....,....),....u,.....,.....,.....,....E-.....-.....-.....-....E.......................a/...../.....0....,0.....0.....0....01....E1.....1.....1.....2....*2....v2.....2.....2.....2....H3.....3.....3.....3....D4

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\locales\zh-TW.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):491017
                                                                                                                                                                                                                Entropy (8bit):6.696102855635661
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:IpP3caOCTyemy5JPFW2uHu4u0JU52UznMi4LnKeze9Tk:qXvmOWzu0JU52UznUeC
                                                                                                                                                                                                                MD5:0BE25A48EECEE48F428FE56FBFA683FD
                                                                                                                                                                                                                SHA1:94C0E8C99BEB592EBAB9EA5B8758AA414BBE7048
                                                                                                                                                                                                                SHA-256:A5E276BDFE4CF87832EEE153596CCDE9CF9193E81F29A4295C8335525DA64295
                                                                                                                                                                                                                SHA-512:423033E67654820AB9F9773F45F70908511AEB8228C59126757885E0BBE0BD960257324D405D27526D61B541B1E6323DE16BEF29D4DCB94F39FD5E92FA811CC8
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.........'..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.&...v.[...w.....y.....z.....|.....}.4.....].....b.....j.....r.....y.....................................................8.......................T.......................@.......................<.......................$.....y.......................J.....k.....x...........(.....N.....h...........%.....T.....i.................J.....W.................(.....4................./.....A.................W.....i.................. ..... ....g ..... ..... ..... ..../!....~!.....!.....!....."....X"....."....."....."....5#....^#....j#.....#.....$....M$....Y$.....$.....$....'%....0%.....%.....%.....&.....&....t&.....&.....'.....'....j'.....'.....'.....'....0(....v(.....(.....(....J)....t).....).....)....3*....d*.....*.....*.....+....!+....-+.....+.....+.....+.....,....s,.....,.....,.....-....|-.....-....=.....L............/....S/....h/...../.....0....G0....S0.....0.....0.....0.....0....M1.....1.....1.....1....=2.....2

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources.pak

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):5755390
                                                                                                                                                                                                                Entropy (8bit):7.996220000544904
                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                SSDEEP:98304:JZ5ti6+nkrht455GGPeenn0mJSwLEpxIvMi8rwrGU3nAaqdkmYAzFKwR4:j7ilnkrP455GGHnhEXU8kr1Xqdf1FvG
                                                                                                                                                                                                                MD5:6772B597BF68622D934F207570E771B1
                                                                                                                                                                                                                SHA1:F2A80FBFA034CB1FA07DC9AA37BF9F5B2280FF13
                                                                                                                                                                                                                SHA-256:268DE4D99AB7C4F4EE32C8E8CB2B058A2C8D0D839F468AE8E8C0605FEAA736EA
                                                                                                                                                                                                                SHA-512:A2BE67DF09951C9EF9200DCCCBDFF13736921522191F0001DA539D5C7F26B5B26A6B810BE6963908F216768C98D21E52486C7E00538CC0730E8C78E78811B85B
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:............f..#..{.V...|.*1..~..4....OG....aI................V...........@..............................................D9....Dc....D.....D.....D.....D.....D,....D" ...D*$...D.$..HE.$..IE.(..JEx*..SE-/..TE.8..UE.G..VE.h..\E.q..]E.r..^E.s..`E*t..aEty..bE....cExo..dE.Z..eE.[...E.\...E.m...Eho...Exs...E.u...E.{...E.....E....E.....E.....E[....E....EV....E.....E.....E7....E.....E.....E2....E.....L9....L.....L.....L+....LP....L.....L(.../Lo...0L5...1L,)..2L.3...Q.D...Q.P...QdY...Q.\...Q._...Q.j...Q.k...Q.l...QAn...Q.....Q.....R.....R....ZdA&..[d"(..\d:=..]d.@..^dpA.._d3D..`d.G..adqI...d.T...d.Y...d._...d.m...d.p...dUu...d.v...d.x...d.y...d.|...d;....d....6eL...7e|...8e...9e5...:e....;e....<e....=e....>e#...?e....@eo...Ae....Be=...Cex....gp....ga0...g.2.....3.....6.....*....X+.....2.....2.....4.....9.....L....K...........a.....g.....9.....Y.................7... .>...<..L..=..M..>..S..?..X..@.cZ..B.]g..C..i..D..s..E..v..F..w..G.i...H.....I.....J.....K.]...L.....M.....N.S...O._...P.L...Q...

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):11930144
                                                                                                                                                                                                                Entropy (8bit):6.847207788160912
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:98304:wM8gj5wrFTmZ1pqGzpEQTEbFSTc99qkx/vAb2cWd:wq5wrFTmZ1pqGzpEQyYcntIb2cs
                                                                                                                                                                                                                MD5:9C152D4B70F76936092601E470E5AC79
                                                                                                                                                                                                                SHA1:BFD8A02A7AF0AE1596A878BB337A76257E7A1CAE
                                                                                                                                                                                                                SHA-256:4AE582261B6EC0A0051AAE56EDEF33BB8AF93BFF4BD7696ECEB3D3C55C233F14
                                                                                                                                                                                                                SHA-512:B95868C3767AABBD7A08A5D298F61045CE61F1F08AFB012444192425FE279F653E82435085177B3722762F5422C4C6B70E6B8CB41BAD93E9C6F1C22EE1FB7D42
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:....P...L...G...{"files":{"node_modules":{"files":{"@babel":{"files":{"generator":{"files":{"LICENSE":{"size":1106,"integrity":{"algorithm":"SHA256","hash":"117da2af0d4ce0fe1c8e19b5cff9dcd806adf973d328d27b11d4448c4ff24f76","blockSize":4194304,"blocks":["117da2af0d4ce0fe1c8e19b5cff9dcd806adf973d328d27b11d4448c4ff24f76"]},"offset":"0"},"lib":{"files":{"buffer.js":{"size":5771,"integrity":{"algorithm":"SHA256","hash":"49d70448373ee7293d57c661383f44e86174059be60d2f8fb98969ae97f16e5e","blockSize":4194304,"blocks":["49d70448373ee7293d57c661383f44e86174059be60d2f8fb98969ae97f16e5e"]},"offset":"1106"},"generators":{"files":{"base.js":{"size":2294,"integrity":{"algorithm":"SHA256","hash":"fb4891bbcaf0f27846b193500bc944213e7cbf2c0feb282795b153d70282e000","blockSize":4194304,"blocks":["fb4891bbcaf0f27846b193500bc944213e7cbf2c0feb282795b153d70282e000"]},"offset":"6877"},"classes.js":{"size":4157,"integrity":{"algorithm":"SHA256","hash":"7f9a3208c888e8ef986bf7cb79a5143fd8bb51308ca17bad9e0a5be0c5251

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\index.js

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:Java source, ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):4000
                                                                                                                                                                                                                Entropy (8bit):5.348928984866719
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:96:umC8wdGAK449W7zAaTkSZPXRS/hLfFBZ8tAemaPe6QaiiFVlPXRYaPJyPXCRy04:93/Gbk4BS5fFL82emJaii/hBLPkXCRyR
                                                                                                                                                                                                                MD5:884E837BDA065828A42D633F81CDFAD5
                                                                                                                                                                                                                SHA1:C1768675091EA6139B90E53853420CCEF9C09A4C
                                                                                                                                                                                                                SHA-256:B7AC5FA0D24DF44755481B9876850FED593423D68C48EED9D30E989879B1864B
                                                                                                                                                                                                                SHA-512:A43BD95B227BA0158A0005A9BFEC6DFDD3AD1CD85BCFBAF37681A7664B4D66E834BDD33484251374F791B5A5D7CBE2DC5CB26BAF0E029712F8977CB5509B9852
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:import process from 'node:process';.import {promisify} from 'node:util';.import path from 'node:path';.import {fileURLToPath} from 'node:url';.import childProcess from 'node:child_process';..const __dirname = path.dirname(fileURLToPath(import.meta.url));..const TEN_MEGABYTES = 1000 * 1000 * 10;.const execFile = promisify(childProcess.execFile);..const windows = async () => {..// Source: https://github.com/MarkTiedemann/fastlist..let binary;..switch (process.arch) {...case 'x64':....binary = 'fastlist-0.3.0-x64.exe';....break;...case 'ia32':....binary = 'fastlist-0.3.0-x86.exe';....break;...default:....throw new Error(`Unsupported architecture: ${process.arch}`);..}...const binaryPath = path.join(__dirname, 'vendor', binary);..const {stdout} = await execFile(binaryPath, {...maxBuffer: TEN_MEGABYTES,...windowsHide: true,..});...return stdout....trim()....split('\r\n')....map(line => line.split('\t'))....map(([pid, ppid, name]) => ({....pid: Number.parseInt(pid, 10),....ppid: Number.parse

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\license

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:ASCII text, with very long lines (460)
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1117
                                                                                                                                                                                                                Entropy (8bit):5.079903213409815
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:24:FHr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:FH8JplPvEDvQHcs5ITc3omFD
                                                                                                                                                                                                                MD5:D5F2A6DD0192DCC7C833E50BB9017337
                                                                                                                                                                                                                SHA1:80674912E3033BE358331910BA27D5812369C2FC
                                                                                                                                                                                                                SHA-256:5C932D88256B4AB958F64A856FA48E8BD1F55BC1D96B8149C65689E0C61789D3
                                                                                                                                                                                                                SHA-512:D1F336FF272BC6B96DC9A04A7D0EF8F02936DD594F514060340478EE575FE01D55FC7A174DF5814A4FAF72C8462B012998ECA7BB898E3F9A3E87205FB9135AF2
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\package.json

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):606
                                                                                                                                                                                                                Entropy (8bit):4.677493590111802
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12:/r1JPknYwUj+T4SHtGwwnH/h6lGP9pek/GacG1GOcIretJYM+ROA:z1JmUrS0JH/hRrsOreJA
                                                                                                                                                                                                                MD5:0D66A224C9A1C343842B7C97E5634EA6
                                                                                                                                                                                                                SHA1:83E8A14CFACEB5A522E91F057CB76FA98162F9A7
                                                                                                                                                                                                                SHA-256:B7A7AF79AE2225F7DEE5B160559468EFC4663CF8DFD2C6E9A068969CB089B003
                                                                                                                                                                                                                SHA-512:E071F659C7C433B55F0F1AED83AE63032618E522D11077DA83E32D9ED072A20B123CB8083129DF7201DD19BCB1D578D87EF256659B74D9E82A0934B725957F38
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:{. "name": "ps-list",. "version": "8.1.1",. "description": "Get running processes",. "license": "MIT",. "repository": "sindresorhus/ps-list",. "funding": "https://github.com/sponsors/sindresorhus",. "author": {. "name": "Sindre Sorhus",. "email": "sindresorhus@gmail.com",. "url": "https://sindresorhus.com". },. "type": "module",. "exports": "./index.js",. "engines": {. "node": "^12.20.0 || ^14.13.1 || >=16.0.0". },. "files": [. "index.js",. "index.d.ts",. "vendor/*.exe". ],. "devDependencies": {. "ava": "^3.15.0",. "tsd": "^0.18.0",. "xo": "^0.46.4". }.}

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):271872
                                                                                                                                                                                                                Entropy (8bit):6.267941112452071
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:JxxmnATc41sT3iVSd87fqCHeohyRDaFsIh:3xmnz41s+VSsfT+o
                                                                                                                                                                                                                MD5:F92F454DE8ECEDD3945DBAEACD381DC3
                                                                                                                                                                                                                SHA1:ED4AA49E15795AC31F1E7CFAEF2E0C16359C5258
                                                                                                                                                                                                                SHA-256:D1A71F9AC1728082C1B276392725C3E010B98714888579B99152E401ABEDBF11
                                                                                                                                                                                                                SHA-512:312D62DA1F41E2B9FE0F15EF30D81A4241F309D83A24643EC8CB99104EF5EF7F52EC216C5CDF0E3995FC5B538DFDFC54E78FBDE3A57EB0AB8BD04DEC07CB5586
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h...,.n.,.n.,.n.w.m.&.n.w.j.>.n.w.k..n...j.<.n...m.&.n...k.}.n.w.o.).n.,.o.L.n..g.-.n....-.n..l.-.n.Rich,.n.........................PE..d......^..........".................D..........@..........................................`.....................................................(....`....... ...#...........p..,.......p..............................0............................................text...\........................... ..`.rdata...I.......J..................@..@.data....*..........................@....pdata...#... ...$..................@..@_RDATA.......P......................@..@.rsrc........`......................@..@.reloc..,....p......................@..B................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exe

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):215040
                                                                                                                                                                                                                Entropy (8bit):6.5588154485327355
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:MuP738wut5T2/efnO310+Hfd+ueCuMvMLAOgp+HQ:MuPL8wut5T2/eCHF+ueCQeQHQ
                                                                                                                                                                                                                MD5:3DE9EE7FE8CF4710DA1C8538A1BD86DF
                                                                                                                                                                                                                SHA1:6FF4B813AD66F0B013222FE044579511A79804D8
                                                                                                                                                                                                                SHA-256:017411F3B0B5C0402CC3B2CB87C32C6FC71ABD82E5B17EA6108990096C75A65D
                                                                                                                                                                                                                SHA-512:0AAB4D484DF289485BEB90EE8B7D929D2D6FA5D7E4385C17B2745DEA40E295F1A9C6C3C8C6C206B46F04A50B51EB01952793FFB84E978C9D0D7447435280ABE7
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HY..)7..)7..)7.A4..)7.A2.Z)7.A3..)7.4F3..)7.4F4..)7.4F2.)7.A6..)7..)6.)7.yY>..)7.yY...)7.yY5..)7.Rich.)7.................PE..L......^.................$.........."z.......@....@.......................................@.................................L$..(....P.......................`... ......p...........................P...@............@..@............................text....".......$.................. ..`.rdata.......@.......(..............@..@.data........0......................@....rsrc........P.......$..............@..@.reloc... ...`..."...&..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\resources\elevate.exe

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):107520
                                                                                                                                                                                                                Entropy (8bit):6.442687067441468
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
                                                                                                                                                                                                                MD5:792B92C8AD13C46F27C7CED0810694DF
                                                                                                                                                                                                                SHA1:D8D449B92DE20A57DF722DF46435BA4553ECC802
                                                                                                                                                                                                                SHA-256:9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
                                                                                                                                                                                                                SHA-512:6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\snapshot_blob.bin

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):316538
                                                                                                                                                                                                                Entropy (8bit):4.177181507694743
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:p+JfFRciefJNlUMX2kIE1aOaVsS/3hYeFWYSITdJgClE+ceNTbM:pefPciePmMXh1aOCsy3hpFRlzVw
                                                                                                                                                                                                                MD5:C8950B01F336B05609976546B1A007E6
                                                                                                                                                                                                                SHA1:F04D0B0369007BBE6A7FE129B31B19DD1822F32F
                                                                                                                                                                                                                SHA-256:9B3A75A713E41BC73F219858FCAC8E3031BA22732285ED3A64DC48074C725CC2
                                                                                                                                                                                                                SHA-512:B7DB4277290E849A52AD5D31FF65AB5D2B75C2125D67EEEE02B09E4E7001AA46D10BF89429C65695C7560D1C45B898C20275EB9E36CD8B259707FFB8B298F103
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:..........(.._.13.0.245.16-electron.0..........................................`L..............l....K..}.a........a........a2.......aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\v8_context_snapshot.bin

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):687473
                                                                                                                                                                                                                Entropy (8bit):5.155441647860749
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:vPYRCOn2E6keR1PciePmMXh1aOCsy3hbHRlEDMrVkSiF01gwoHZHCvqmO9iXz8pk:vPY5nnbe3WZBr/iXo73nVE+2l
                                                                                                                                                                                                                MD5:BF2976DA5086B48D74EB36F56F5DEB83
                                                                                                                                                                                                                SHA1:5AA7669A3E2166FDD7534241A0E7A9BD3FF5748B
                                                                                                                                                                                                                SHA-256:9F1614328E18BECB4ADF96DE98BC91CE2A69274ABE6621327CC0FC8503A1AB20
                                                                                                                                                                                                                SHA-512:C44DEEB96597B4498604ECF2060EE0520E84A00308CA1F47FFDF8E3ED3E676B27B622FF7DBD4B6F1A14CE60B05CC2AD9B8D7562BB362C1B12A885EA7FBE50E0A
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:...........a.na.13.0.245.16-electron.0..............................................!...i...1...q.......l...x...}.a........a........a........aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\vk_swiftshader.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):5533184
                                                                                                                                                                                                                Entropy (8bit):6.341413194477468
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:49152:zBVtMrKyOsxYYAKDsJS86IxORjgUlC3K/FAz4gdm6o4oX7uh5LC6MW4LY67h772c:jWKyOEnOnoLrWbfDiN9isC
                                                                                                                                                                                                                MD5:6720D5DCDA6737EB0CC5A352A47414DC
                                                                                                                                                                                                                SHA1:03D9A8E350F485DD955F7DEE06BFC46371753032
                                                                                                                                                                                                                SHA-256:D8F36B089D83157ABC271D9FE125919C3237943FA9789A511AC5EF1D41E2E3AF
                                                                                                                                                                                                                SHA-512:DE5ADE6CE14B14957FCE669C4181AF1E6A6F540798D1C6720B56FF281F813A6CE4446BDE33A8F175D2484E07F4911F93A773CAC1D372CBE3B26BE634B3FA1686
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......B.........P.;.......................................U...........`A..........................................O.......O.P....PU.......S..W...........`U.......O......................O.(.....B.@.............P.8............................text...g.B.......B................. ..`.rdata........B.......B.............@..@.data...H.....P.......P.............@....pdata...W....S..X...VR.............@..@.gxfg...0.....T..0....S.............@..@.retplne..... U.......S..................tls....Y....0U.......S.............@..._RDATA.......@U.......S.............@..@.rsrc........PU.......S.............@..@.reloc.......`U.......S.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\vk_swiftshader_icd.json

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):106
                                                                                                                                                                                                                Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\7z-out\vulkan-1.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):894976
                                                                                                                                                                                                                Entropy (8bit):6.60309283089771
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:24576:FhJnfYUcguY3cTAL6Z5WjDYsHy6g3P0zAk7TNb:FhVrXN3oAL6Z5WjDYsHy6g3P0zAk7T
                                                                                                                                                                                                                MD5:B6D3AF84E8BE0027741AA6077768789E
                                                                                                                                                                                                                SHA1:E525F2434DC56F79644695F5841E91DD5F80EEC4
                                                                                                                                                                                                                SHA-256:376FF6892EC7B406ACD8C455AC82F8541E59E3757195488FF04CD9F20D554562
                                                                                                                                                                                                                SHA-512:F03B8792A740679C8A1A8CE0615B7876CC811130085F3FFB42182E0CB846519603804DA97FC93A8ABEBEE01E03FD257DF289C54575DA8FAAAD018F4F4BAE606A
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .........................................................@............`A........................................PL..<!...m..P.... .......P..ha...........0..$....:.......................9..(.......@............q...............................text............................... ..`.rdata..............................@..@.data....L......."..................@....pdata..ha...P...b..................@..@.gxfg....%.......&...j..............@..@.retplne.................................tls................................@..._RDATA..............................@..@.rsrc........ ......................@..@.reloc..$....0......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\SpiderBanner.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):9216
                                                                                                                                                                                                                Entropy (8bit):5.5347224014600345
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
                                                                                                                                                                                                                MD5:17309E33B596BA3A5693B4D3E85CF8D7
                                                                                                                                                                                                                SHA1:7D361836CF53DF42021C7F2B148AEC9458818C01
                                                                                                                                                                                                                SHA-256:996A259E53CA18B89EC36D038C40148957C978C0FD600A268497D4C92F882A93
                                                                                                                                                                                                                SHA-512:1ABAC3CE4F2D5E4A635162E16CF9125E059BA1539F70086C2D71CD00D41A6E2A54D468E6F37792E55A822D7082FB388B8DFECC79B59226BBB047B7D28D44D298
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../../../..Wy./../../....../..Wi./..Wx./..W~./..W{./..Rich./..................PE..L...T{mW...........!................p!.......0...............................p............@..........................5..o...l1..P....P.......................`.......................................................0...............................text............................... ..`.rdata.......0......................@..@.data........@......................@....rsrc........P......................@..@.reloc..d....`....... ..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\StdUtils.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):102400
                                                                                                                                                                                                                Entropy (8bit):6.729923587623207
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
                                                                                                                                                                                                                MD5:C6A6E03F77C313B267498515488C5740
                                                                                                                                                                                                                SHA1:3D49FC2784B9450962ED6B82B46E9C3C957D7C15
                                                                                                                                                                                                                SHA-256:B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
                                                                                                                                                                                                                SHA-512:9870C5879F7B72836805088079AD5BBAFCB59FC3D9127F2160D4EC3D6E88D3CC8EBE5A9F5D20A4720FE6407C1336EF10F33B2B9621BC587E930D4CBACF337803
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q....C...C...C...C...C...C...C...C...C...C...C...C...C.[.C...C.[.C...C.[.C...C.[.C...CRich...C........................PE..L...I..[...........!.....*...b...............@.......................................+....@..........................}..d....t..........X............................................................................@...............................text....).......*.................. ..`.rdata..TC...@...D..................@..@.data...l............r..............@....rsrc...X............x..............@..@.reloc..j............~..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\System.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):12288
                                                                                                                                                                                                                Entropy (8bit):5.719859767584478
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
                                                                                                                                                                                                                MD5:0D7AD4F45DC6F5AA87F606D0331C6901
                                                                                                                                                                                                                SHA1:48DF0911F0484CBE2A8CDD5362140B63C41EE457
                                                                                                                                                                                                                SHA-256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
                                                                                                                                                                                                                SHA-512:C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\app-64.7z

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:7-zip archive data, version 0.4
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):86110010
                                                                                                                                                                                                                Entropy (8bit):7.999996289901596
                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                SSDEEP:1572864:P2/ebAbWfHzDGFLsoabh+XJhXhQiB1dJdYVkq7U9GOWwMMArXPWEUyGDM:70b+/GhzOh01VJY+qw9dxQXPzbGDM
                                                                                                                                                                                                                MD5:665A199B0FC5370D7B57EB6CA52BF8E2
                                                                                                                                                                                                                SHA1:EB7712D371202D18B8901E298174F975F56EBB56
                                                                                                                                                                                                                SHA-256:6ADF7C0BE6D21D2BA5E46CB3A72FCA023F5EC445BAAE937378746C9C23828EBF
                                                                                                                                                                                                                SHA-512:8B463364AB4F5BF42FF53D22D6D05A3089BDB4194A9F8704EB471C475C981600FC4FED6313AE977D1344D60B516B9DBB78B00A9E28C41FF379C101AA3E88E80D
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:7z..'.........!.....%..........i....]...6.....#.0@.1.zL..[...4b ...A....Z7.~...........}.......m.7!*Q..X,s..T...>~(|.s..%...1`.Yw......vK.Tz.|pu.96...D.......w,2PO;I..Z.{..I..y.pn...P..*G.a...Z...(....R..R8|.\....L...k..}..s&.'.....0.."o.s.ZI.=.(.C.?.Gg...|..^....;.e[.w....<.n.@..&Z...$`p ..OzD...V..r.l...ibH..hv."6.m.5.T{*4nh.....Sx.G..1.'.....8.."..................Zk!`.fd..qN.....{.......O.$.|r.{.a|^.]..K*n..t..e.......o.s.v}.....2[M..1..yG..]Y. ...Z=....?.\#*..)...!k...X....G.%>......t..7.}.G.~HV..D.[.....4....!.....=.r.../P.5*..j1^.!..W).!...J.!H0....Rj..[..0.y.u...5..bC...\..{...Cv...`xN|....2m.A.{..m..y).*B.q.D.y...j.\.R#.CX\n..L>.NN.]..cj{>..p.j}.&..Z<.`7....o.......k..z.. ...?..~g.|m....kysn.q.., b>'.:,p...... .......V..x........0j.......F..3....W.......xO.....w.q..a....s.4#.GWP.........r'...K....+_^"0T=.+.....u)......xEP.Il.}.P>.@{.9{.......*...Q..E..[..[34..wx....Z...$..U.....vg....k.......Z.$j....#.b.rF....#5...XO.u...saZ...'.

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\nsExec.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):6656
                                                                                                                                                                                                                Entropy (8bit):5.155286976455086
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
                                                                                                                                                                                                                MD5:EC0504E6B8A11D5AAD43B296BEEB84B2
                                                                                                                                                                                                                SHA1:91B5CE085130C8C7194D66B2439EC9E1C206497C
                                                                                                                                                                                                                SHA-256:5D9CEB1CE5F35AEA5F9E5A0C0EDEEEC04DFEFE0C77890C80C70E98209B58B962
                                                                                                                                                                                                                SHA-512:3F918F1B47E8A919CBE51EB17DC30ACC8CFC18E743A1BAE5B787D0DB7D26038DC1210BE98BF5BA3BE8D6ED896DBBD7AC3D13E66454A98B2A38C7E69DAD30BB57
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....~.\...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsu393D.tmp\nsis7z.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):434176
                                                                                                                                                                                                                Entropy (8bit):6.584811966667578
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
                                                                                                                                                                                                                MD5:80E44CE4895304C6A3A831310FBF8CD0
                                                                                                                                                                                                                SHA1:36BD49AE21C460BE5753A904B4501F1ABCA53508
                                                                                                                                                                                                                SHA-256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
                                                                                                                                                                                                                SHA-512:C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\FlowUs\269f44bc-34c2-474b-a068-98cba3a4154f.tmp

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe
                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                Size (bytes):434
                                                                                                                                                                                                                Entropy (8bit):5.6393327952914225
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12:YKWSCuj9rrt+dkGik9QVPYAbN8EGbkKH/gD:YKWJu5rrt969QVPz4b7YD
                                                                                                                                                                                                                MD5:AA561E858A2F759B498847C9DF2A03B1
                                                                                                                                                                                                                SHA1:80E841158FE5A682786FDC39F971DFA2AF73A03C
                                                                                                                                                                                                                SHA-256:D9451317E5EE1BFA1BCDA35B07570A13490BC1577943C4ECAFA52D0D8DA557F1
                                                                                                                                                                                                                SHA-512:5942F18E8AD84C780D812FA8A263989FFFACDA96C074BF6A4D4C31B325CE5C1EB898ED5E05B6D582CE6A3A2679BD5CCDA2AB38E8D3DE36EDC8770B0538711E91
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAB70EwUaXmmQKX2CC7r3zTiEAAAABIAAABDAGgAcgBvAG0AaQB1AG0AAAAQZgAAAAEAACAAAAC+cWeKKvfWMuvZCfbQHGmcP5FHVMBgN0cODH/4PUrA6AAAAAAOgAAAAAIAACAAAAARKZV3Q/NQQgdhHAtFtfScKROhTiuf8GCPwubWjOmoszAAAABFnAk1prXCEyVJg0VMjPIhWpAsH7h9fIfnl1VYngvVDZaFCYhoLsJawP3K7ugu8YZAAAAAahLX1YQ8RVPoKijlLMzlUHgezPqdTbp9rMCQEHwCS8p4dIejOj7k0tNSfMnz4pVcf15XiKfkc0yMnBXDgMaifQ=="}}

                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\FlowUs\Local State (copy)

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe
                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):434
                                                                                                                                                                                                                Entropy (8bit):5.6393327952914225
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12:YKWSCuj9rrt+dkGik9QVPYAbN8EGbkKH/gD:YKWJu5rrt969QVPz4b7YD
                                                                                                                                                                                                                MD5:AA561E858A2F759B498847C9DF2A03B1
                                                                                                                                                                                                                SHA1:80E841158FE5A682786FDC39F971DFA2AF73A03C
                                                                                                                                                                                                                SHA-256:D9451317E5EE1BFA1BCDA35B07570A13490BC1577943C4ECAFA52D0D8DA557F1
                                                                                                                                                                                                                SHA-512:5942F18E8AD84C780D812FA8A263989FFFACDA96C074BF6A4D4C31B325CE5C1EB898ED5E05B6D582CE6A3A2679BD5CCDA2AB38E8D3DE36EDC8770B0538711E91
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAB70EwUaXmmQKX2CC7r3zTiEAAAABIAAABDAGgAcgBvAG0AaQB1AG0AAAAQZgAAAAEAACAAAAC+cWeKKvfWMuvZCfbQHGmcP5FHVMBgN0cODH/4PUrA6AAAAAAOgAAAAAIAACAAAAARKZV3Q/NQQgdhHAtFtfScKROhTiuf8GCPwubWjOmoszAAAABFnAk1prXCEyVJg0VMjPIhWpAsH7h9fIfnl1VYngvVDZaFCYhoLsJawP3K7ugu8YZAAAAAahLX1YQ8RVPoKijlLMzlUHgezPqdTbp9rMCQEHwCS8p4dIejOj7k0tNSfMnz4pVcf15XiKfkc0yMnBXDgMaifQ=="}}

                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\FlowUs\config.json

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe
                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):73
                                                                                                                                                                                                                Entropy (8bit):4.6553962236972115
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:NBH15D6QHIx2HRGTWHJq8BHEKY:L15DjTxGT+q8BHEKY
                                                                                                                                                                                                                MD5:1AD82D104BB3AA85A0495E615B49C11D
                                                                                                                                                                                                                SHA1:E7299F709FBA57C7EA8F5CFADEFFAF5DE6505654
                                                                                                                                                                                                                SHA-256:A703700FA7C9304E14199AE737783406851C5F591B870E3E668248D55A6126F3
                                                                                                                                                                                                                SHA-512:812006BF2CE1AB2FC9217C231902B122C6FE7F98A3F96BB61946833C4CF27ABD253E123278E5C830C4D40D0E74916F98591283A7092269177954C809DF602DB6
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:{. "uuid": "7fb3ff0b-5bbb-42e6-9a10-ec9e1994c313",. "installed": true.}

                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Nov 15 06:23:00 2024, mtime=Fri Nov 15 06:23:11 2024, atime=Thu Nov 14 10:21:44 2024, length=188699136, window=hide
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1177
                                                                                                                                                                                                                Entropy (8bit):4.902567103960179
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:24:8lf1D8wV7R5L6TC26ulyA2tGYfe75p7qygm:8lyIR5LsPX2tGVCyg
                                                                                                                                                                                                                MD5:42A99DDB5F14E7D4C6DFE3E24D59C9EF
                                                                                                                                                                                                                SHA1:1D5C153025BECCF3D10A3310CD944C4897977195
                                                                                                                                                                                                                SHA-256:A5A83AE3D8F29057F09565377F852FB12F473B3F8441A6A4413FE2F1A7B02604
                                                                                                                                                                                                                SHA-512:327527111E3F10DF51BAC7A6F083A8515A5B1031BB075E566E526D803C2AFAC09855EF204AE2C8E9198271C571626F4D402A7462DB6563E9D194F0D1DD3A3AAC
                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                Preview:L..................F.... ...x5y3/7..a..9/7...T.b.6...R?.......................:..DG..Yr?.D..U..k0.&...&...... M.....P{.!/7..~I.;/7......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSloY.:....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....oY.:..Local.<......DWSloY.:....V.........................L.o.c.a.l.....Z.1.....oY.:..Programs..B......oY.:oY.:....S.......................<.P.r.o.g.r.a.m.s.....T.1.....oY.:..FlowUs..>......oY.:oY.:....z........................F.l.o.w.U.s.....`.2..R?.nY.Z .FlowUs.exe..F......oY.:oY.:....~'........................F.l.o.w.U.s...e.x.e.......g...............-.......f.............(......C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe..2.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.F.l.o.w.U.s.\.F.l.o.w.U.s...e.x.e.............:...........|....I.J.H..K..:...`.......X.......585948...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q....

                                                                                                                                                                                                                \Device\Null

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe
                                                                                                                                                                                                                File Type:ASCII text, with very long lines (427)
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):902
                                                                                                                                                                                                                Entropy (8bit):4.918526629019472
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12:CwCUUC7QgI/6EJdWdV+hI/6EJxSqzDtTdowjN00L/WUu5QAmH+NcczIXoeZC+F:7UKQgW6z+hWHDLyE/xmQoNcckXoex
                                                                                                                                                                                                                MD5:17F6BA65A81C18D67BF7F97497BAE9AF
                                                                                                                                                                                                                SHA1:31D3CF04D3B1DB55599D3DBEEE6A7FDB8ED76415
                                                                                                                                                                                                                SHA-256:445DCB54CEF3EE5908173CC20BB6693BEB5789F0017ECD79F3F5FA79C6D195C3
                                                                                                                                                                                                                SHA-512:38A0A639AB012884D759A5EA86F2199CCBDA0F197232E5914118728D9E860057A1FA018CF48CDED340490101548F9A8685AAE421336E42E32DE7CC59F1DA9AE6
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:(node:5044) UnhandledPromiseRejectionWarning: TypeError: Cannot read properties of undefined (reading 'model'). at getSystemInfo (C:\Users\user\AppData\Local\Programs\FlowUs\resources\app.asar\main.js:50:31). at App.<anonymous> (C:\Users\user\AppData\Local\Programs\FlowUs\resources\app.asar\main.js:329:24). at process.processTicksAndRejections (node:internal/process/task_queues:95:5).(Use `FlowUs --trace-warnings ...` to show where the warning was created).(node:5044) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag `--unhandled-rejections=strict` (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 1).

                                                                                                                                                                                                                Static File Info

                                                                                                                                                                                                                General

                                                                                                                                                                                                                File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                Entropy (8bit):7.999988019573324
                                                                                                                                                                                                                TrID:
                                                                                                                                                                                                                • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                File name:kCKthbZCUf.exe
                                                                                                                                                                                                                File size:86'624'960 bytes
                                                                                                                                                                                                                MD5:e609504d8de12795520521d72727bfd9
                                                                                                                                                                                                                SHA1:fe2e6f021f4bd6e0c3de23929273a0448c50982e
                                                                                                                                                                                                                SHA256:e4b06d32b35cf5d7c513abd7a5f440d48ff52fb73882366b4529b05653bb620c
                                                                                                                                                                                                                SHA512:b877e18e0b79a0bd2a5b93307832fd68a875ee2bb8e316c8b2e0c5d118a2fb66612131b5306b3c9d9eac6c78504fb83d255a3484da53a2c67ffafbe8cb4edf54
                                                                                                                                                                                                                SSDEEP:1572864:Vw2/ebAbWfHzDGFLsoabh+XJhXhQiB1dJdYVkq7U9GOWwMMArXPWEUyGDj:V60b+/GhzOh01VJY+qw9dxQXPzbGDj
                                                                                                                                                                                                                TLSH:4718332C0D48C2B7C31854BDF7F6C2EB4065B7134A0E2B6D223AB27CD75A2E72568597
                                                                                                                                                                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

                                                                                                                                                                                                                File Icon

                                                                                                                                                                                                                Icon Hash:130253939a1a1b04

                                                                                                                                                                                                                Static PE Info

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Entrypoint:0x40338f
                                                                                                                                                                                                                Entrypoint Section:.text
                                                                                                                                                                                                                Digitally signed:true
                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                Subsystem:windows gui
                                                                                                                                                                                                                Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                                                                DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                Time Stamp:0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
                                                                                                                                                                                                                TLS Callbacks:
                                                                                                                                                                                                                CLR (.Net) Version:
                                                                                                                                                                                                                OS Version Major:4
                                                                                                                                                                                                                OS Version Minor:0
                                                                                                                                                                                                                File Version Major:4
                                                                                                                                                                                                                File Version Minor:0
                                                                                                                                                                                                                Subsystem Version Major:4
                                                                                                                                                                                                                Subsystem Version Minor:0
                                                                                                                                                                                                                Import Hash:b34f154ec913d2d2c435cbd644e91687

                                                                                                                                                                                                                Authenticode Signature

                                                                                                                                                                                                                Signature Valid:false
                                                                                                                                                                                                                Signature Issuer:CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
                                                                                                                                                                                                                Signature Validation Error:A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file
                                                                                                                                                                                                                Error Number:-2146762495
                                                                                                                                                                                                                Not Before, Not After
                                                                                                                                                                                                                • 15/10/2024 20:29:09 16/10/2025 20:29:09
                                                                                                                                                                                                                Subject Chain
                                                                                                                                                                                                                • CN="Lion Software, LLC", O="Lion Software, LLC", STREET=60 County Road 537, L=Centre, S=Alabama, C=US, OID.1.3.6.1.4.1.311.60.2.1.2=Alabama, OID.1.3.6.1.4.1.311.60.2.1.3=US, SERIALNUMBER=000-541-240, OID.2.5.4.15=Private Organization
                                                                                                                                                                                                                Version:3
                                                                                                                                                                                                                Thumbprint MD5:AC575FB5F87D72747656ED9FFBAEB0DA
                                                                                                                                                                                                                Thumbprint SHA-1:A243692CD9205CFE32BEEF144B7D84350F3AA0E6
                                                                                                                                                                                                                Thumbprint SHA-256:482DFF658DB3FF3B08ED60A99B5434DE6E8CF3F1DCB782831AA0B22978F7C49D
                                                                                                                                                                                                                Serial:1AF0A44396DD57AC87ECB79D

                                                                                                                                                                                                                Entrypoint Preview

                                                                                                                                                                                                                Instruction
                                                                                                                                                                                                                sub esp, 000002D4h
                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                push esi
                                                                                                                                                                                                                push edi
                                                                                                                                                                                                                push 00000020h
                                                                                                                                                                                                                pop edi
                                                                                                                                                                                                                xor ebx, ebx
                                                                                                                                                                                                                push 00008001h
                                                                                                                                                                                                                mov dword ptr [esp+14h], ebx
                                                                                                                                                                                                                mov dword ptr [esp+10h], 0040A2E0h
                                                                                                                                                                                                                mov dword ptr [esp+1Ch], ebx
                                                                                                                                                                                                                call dword ptr [004080A8h]
                                                                                                                                                                                                                call dword ptr [004080A4h]
                                                                                                                                                                                                                and eax, BFFFFFFFh
                                                                                                                                                                                                                cmp ax, 00000006h
                                                                                                                                                                                                                mov dword ptr [0047AEECh], eax
                                                                                                                                                                                                                je 00007FCF386E9B23h
                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                call 00007FCF386ECDD5h
                                                                                                                                                                                                                cmp eax, ebx
                                                                                                                                                                                                                je 00007FCF386E9B19h
                                                                                                                                                                                                                push 00000C00h
                                                                                                                                                                                                                call eax
                                                                                                                                                                                                                mov esi, 004082B0h
                                                                                                                                                                                                                push esi
                                                                                                                                                                                                                call 00007FCF386ECD4Fh
                                                                                                                                                                                                                push esi
                                                                                                                                                                                                                call dword ptr [00408150h]
                                                                                                                                                                                                                lea esi, dword ptr [esi+eax+01h]
                                                                                                                                                                                                                cmp byte ptr [esi], 00000000h
                                                                                                                                                                                                                jne 00007FCF386E9AFCh
                                                                                                                                                                                                                push 0000000Ah
                                                                                                                                                                                                                call 00007FCF386ECDA8h
                                                                                                                                                                                                                push 00000008h
                                                                                                                                                                                                                call 00007FCF386ECDA1h
                                                                                                                                                                                                                push 00000006h
                                                                                                                                                                                                                mov dword ptr [0047AEE4h], eax
                                                                                                                                                                                                                call 00007FCF386ECD95h
                                                                                                                                                                                                                cmp eax, ebx
                                                                                                                                                                                                                je 00007FCF386E9B21h
                                                                                                                                                                                                                push 0000001Eh
                                                                                                                                                                                                                call eax
                                                                                                                                                                                                                test eax, eax
                                                                                                                                                                                                                je 00007FCF386E9B19h
                                                                                                                                                                                                                or byte ptr [0047AEEFh], 00000040h
                                                                                                                                                                                                                push ebp
                                                                                                                                                                                                                call dword ptr [00408044h]
                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                call dword ptr [004082A0h]
                                                                                                                                                                                                                mov dword ptr [0047AFB8h], eax
                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                lea eax, dword ptr [esp+34h]
                                                                                                                                                                                                                push 000002B4h
                                                                                                                                                                                                                push eax
                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                push 00440208h
                                                                                                                                                                                                                call dword ptr [00408188h]
                                                                                                                                                                                                                push 0040A2C8h

                                                                                                                                                                                                                Rich Headers

                                                                                                                                                                                                                Programming Language:
                                                                                                                                                                                                                • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                                                                                                Data Directories

                                                                                                                                                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x19f0000x6210.rsrc
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x529b8980x1228
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                Sections

                                                                                                                                                                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                .text0x10000x66270x68007618d4c0cd8bb67ea9595b4266b3a91fFalse0.6646259014423077data6.450282348506287IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                .rdata0x80000x14a20x1600eecac1fed9cc6b447d50940d178404d8False0.4405184659090909data5.025178929113415IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                .data0xa0000x70ff80x600db8f31a08a2242d80c29e1f9500c6527False0.5182291666666666data4.037117731448378IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                .ndata0x7b0000x1240000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                .rsrc0x19f0000x62100x640060b51c362a1e8dc51102b7425af5d510False0.7028515625data6.941597564975447IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                Resources

                                                                                                                                                                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                RT_ICON0x19f4a80x4055PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9721294553403363
                                                                                                                                                                                                                RT_DIALOG0x1a35000x202dataEnglishUnited States0.4085603112840467
                                                                                                                                                                                                                RT_DIALOG0x1a37080xf8dataEnglishUnited States0.6290322580645161
                                                                                                                                                                                                                RT_DIALOG0x1a38000xeedataEnglishUnited States0.6260504201680672
                                                                                                                                                                                                                RT_DIALOG0x1a38f00x1fadataEnglishUnited States0.40118577075098816
                                                                                                                                                                                                                RT_DIALOG0x1a3af00xf0dataEnglishUnited States0.6666666666666666
                                                                                                                                                                                                                RT_DIALOG0x1a3be00xe6dataEnglishUnited States0.6565217391304348
                                                                                                                                                                                                                RT_DIALOG0x1a3cc80x1eedataEnglishUnited States0.38866396761133604
                                                                                                                                                                                                                RT_DIALOG0x1a3eb80xe4dataEnglishUnited States0.6447368421052632
                                                                                                                                                                                                                RT_DIALOG0x1a3fa00xdadataEnglishUnited States0.6422018348623854
                                                                                                                                                                                                                RT_DIALOG0x1a40800x1eedataEnglishUnited States0.3866396761133603
                                                                                                                                                                                                                RT_DIALOG0x1a42700xe4dataEnglishUnited States0.6359649122807017
                                                                                                                                                                                                                RT_DIALOG0x1a43580xdadataEnglishUnited States0.6376146788990825
                                                                                                                                                                                                                RT_DIALOG0x1a44380x1f2dataEnglishUnited States0.39759036144578314
                                                                                                                                                                                                                RT_DIALOG0x1a46300xe8dataEnglishUnited States0.6508620689655172
                                                                                                                                                                                                                RT_DIALOG0x1a47180xdedataEnglishUnited States0.6486486486486487
                                                                                                                                                                                                                RT_DIALOG0x1a47f80x202dataEnglishUnited States0.42217898832684825
                                                                                                                                                                                                                RT_DIALOG0x1a4a000xf8dataEnglishUnited States0.6653225806451613
                                                                                                                                                                                                                RT_DIALOG0x1a4af80xeedataEnglishUnited States0.6512605042016807
                                                                                                                                                                                                                RT_GROUP_ICON0x1a4be80x14dataEnglishUnited States1.05
                                                                                                                                                                                                                RT_VERSION0x1a4c000x1e8dataEnglishUnited States0.5122950819672131
                                                                                                                                                                                                                RT_MANIFEST0x1a4de80x423XML 1.0 document, ASCII text, with very long lines (1059), with no line terminatorsEnglishUnited States0.5127478753541076

                                                                                                                                                                                                                Imports

                                                                                                                                                                                                                DLLImport
                                                                                                                                                                                                                KERNEL32.dllSetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
                                                                                                                                                                                                                USER32.dllGetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
                                                                                                                                                                                                                GDI32.dllSelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                                                                                                                                                                                SHELL32.dllSHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
                                                                                                                                                                                                                ADVAPI32.dllAdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
                                                                                                                                                                                                                COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                                                                                                                                                                                ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                                                                                                                                                                                Possible Origin

                                                                                                                                                                                                                Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                EnglishUnited States

                                                                                                                                                                                                                Network Behavior

                                                                                                                                                                                                                ⊘No network behavior found

                                                                                                                                                                                                                Statistics

                                                                                                                                                                                                                CPU Usage

                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                Memory Usage

                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                High Level Behavior Distribution

                                                                                                                                                                                                                Click to dive into process behavior distribution

                                                                                                                                                                                                                Behavior

                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                System Behavior

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:0
                                                                                                                                                                                                                Start time:02:22:39
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Users\user\Desktop\kCKthbZCUf.exe
                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                Commandline:"C:\Users\user\Desktop\kCKthbZCUf.exe"
                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                File size:86'624'960 bytes
                                                                                                                                                                                                                MD5 hash:E609504D8DE12795520521D72727BFD9
                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:2
                                                                                                                                                                                                                Start time:02:22:40
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                Commandline:"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq FlowUs.exe" /FO csv | "C:\Windows\system32\find.exe" "FlowUs.exe"
                                                                                                                                                                                                                Imagebase:0x790000
                                                                                                                                                                                                                File size:236'544 bytes
                                                                                                                                                                                                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:3
                                                                                                                                                                                                                Start time:02:22:40
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:4
                                                                                                                                                                                                                Start time:02:22:40
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                Commandline:tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq FlowUs.exe" /FO csv
                                                                                                                                                                                                                Imagebase:0x8e0000
                                                                                                                                                                                                                File size:79'360 bytes
                                                                                                                                                                                                                MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:5
                                                                                                                                                                                                                Start time:02:22:40
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\find.exe
                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                Commandline:"C:\Windows\system32\find.exe" "FlowUs.exe"
                                                                                                                                                                                                                Imagebase:0x3d0000
                                                                                                                                                                                                                File size:14'848 bytes
                                                                                                                                                                                                                MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Reputation:moderate
                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:7
                                                                                                                                                                                                                Start time:02:23:08
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe
                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe"
                                                                                                                                                                                                                Imagebase:0x7ff6dea90000
                                                                                                                                                                                                                File size:188'699'136 bytes
                                                                                                                                                                                                                MD5 hash:122EEE4C63DBC533BA58218E75C43098
                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Antivirus matches:
                                                                                                                                                                                                                • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:11
                                                                                                                                                                                                                Start time:02:23:11
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                Commandline:C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()""
                                                                                                                                                                                                                Imagebase:0x7ff74e280000
                                                                                                                                                                                                                File size:289'792 bytes
                                                                                                                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:12
                                                                                                                                                                                                                Start time:02:23:12
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe
                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1880,i,3782882238423362447,8962928300536026474,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
                                                                                                                                                                                                                Imagebase:0x7ff6dea90000
                                                                                                                                                                                                                File size:188'699'136 bytes
                                                                                                                                                                                                                MD5 hash:122EEE4C63DBC533BA58218E75C43098
                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:13
                                                                                                                                                                                                                Start time:02:23:11
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:14
                                                                                                                                                                                                                Start time:02:23:11
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                Commandline:powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()"
                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:15
                                                                                                                                                                                                                Start time:02:23:15
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe
                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --field-trial-handle=2428,i,3782882238423362447,8962928300536026474,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
                                                                                                                                                                                                                Imagebase:0x7ff6dea90000
                                                                                                                                                                                                                File size:188'699'136 bytes
                                                                                                                                                                                                                MD5 hash:122EEE4C63DBC533BA58218E75C43098
                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:16
                                                                                                                                                                                                                Start time:02:23:26
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe
                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe"
                                                                                                                                                                                                                Imagebase:0x7ff6dea90000
                                                                                                                                                                                                                File size:188'699'136 bytes
                                                                                                                                                                                                                MD5 hash:122EEE4C63DBC533BA58218E75C43098
                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:17
                                                                                                                                                                                                                Start time:02:23:27
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe
                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1752,i,11422593095879954725,17316753855438622449,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
                                                                                                                                                                                                                Imagebase:0x7ff6dea90000
                                                                                                                                                                                                                File size:188'699'136 bytes
                                                                                                                                                                                                                MD5 hash:122EEE4C63DBC533BA58218E75C43098
                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:18
                                                                                                                                                                                                                Start time:02:23:26
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                Commandline:C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()""
                                                                                                                                                                                                                Imagebase:0x7ff74e280000
                                                                                                                                                                                                                File size:289'792 bytes
                                                                                                                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:19
                                                                                                                                                                                                                Start time:02:23:26
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:20
                                                                                                                                                                                                                Start time:02:23:26
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                Commandline:powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe';$s.Save()"
                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:21
                                                                                                                                                                                                                Start time:02:23:28
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe
                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --field-trial-handle=2420,i,11422593095879954725,17316753855438622449,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
                                                                                                                                                                                                                Imagebase:0x7ff6dea90000
                                                                                                                                                                                                                File size:188'699'136 bytes
                                                                                                                                                                                                                MD5 hash:122EEE4C63DBC533BA58218E75C43098
                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:22
                                                                                                                                                                                                                Start time:02:25:11
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe
                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1184,i,3782882238423362447,8962928300536026474,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:8
                                                                                                                                                                                                                Imagebase:0x7ff6dea90000
                                                                                                                                                                                                                File size:188'699'136 bytes
                                                                                                                                                                                                                MD5 hash:122EEE4C63DBC533BA58218E75C43098
                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:23
                                                                                                                                                                                                                Start time:02:25:27
                                                                                                                                                                                                                Start date:15/11/2024
                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe
                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Programs\FlowUs\FlowUs.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\FlowUs" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1188,i,11422593095879954725,17316753855438622449,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:8
                                                                                                                                                                                                                Imagebase:0x7ff6dea90000
                                                                                                                                                                                                                File size:188'699'136 bytes
                                                                                                                                                                                                                MD5 hash:122EEE4C63DBC533BA58218E75C43098
                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                Disassembly

                                                                                                                                                                                                                ⊘No disassembly