Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
G4fDWS1Fpd.exe

Overview

General Information

Sample name:G4fDWS1Fpd.exe
renamed because original name is a hash value
Original sample name:fac7f1a54eef98830ecbd25fef364695b8afd9e255dcc19702dac84ee526c5ca.exe
Analysis ID:1556260
MD5:2e0143d084a2217b24f58d597169cb16
SHA1:599870ccdec203f715cdd37ebf402df36400c1e4
SHA256:fac7f1a54eef98830ecbd25fef364695b8afd9e255dcc19702dac84ee526c5ca
Tags:exeLionSoftwareLLCuser-JAMESWT_MHT
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Sigma detected: Powershell create lnk in startup
Drops large PE files
Powershell creates an autostart link
Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Drops PE files
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • G4fDWS1Fpd.exe (PID: 2360 cmdline: "C:\Users\user\Desktop\G4fDWS1Fpd.exe" MD5: 2E0143D084A2217B24F58D597169CB16)
    • cmd.exe (PID: 3196 cmdline: "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Slax.exe" /FO csv | "C:\Windows\system32\find.exe" "Slax.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 5872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • tasklist.exe (PID: 936 cmdline: tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Slax.exe" /FO csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
      • find.exe (PID: 1460 cmdline: "C:\Windows\system32\find.exe" "Slax.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
  • Slax.exe (PID: 6484 cmdline: "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" MD5: 262797985453830673179336B6BACAC6)
    • Slax.exe (PID: 5864 cmdline: "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1816,i,11646247368897797242,13434058048070250299,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2 MD5: 262797985453830673179336B6BACAC6)
    • cmd.exe (PID: 6084 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 2548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 6268 cmdline: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • Slax.exe (PID: 4492 cmdline: "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2584,i,11646247368897797242,13434058048070250299,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:3 MD5: 262797985453830673179336B6BACAC6)
  • Slax.exe (PID: 1444 cmdline: "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" MD5: 262797985453830673179336B6BACAC6)
    • cmd.exe (PID: 5564 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 6512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 1456 cmdline: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • Slax.exe (PID: 6504 cmdline: "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1864,i,400091264659153544,17151257105363730347,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2 MD5: 262797985453830673179336B6BACAC6)
    • Slax.exe (PID: 5264 cmdline: "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2392,i,400091264659153544,17151257105363730347,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3 MD5: 262797985453830673179336B6BACAC6)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
Source: File createdAuthor: Christopher Peacock '@securepeacock', SCYTHE: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6268, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk
Sigma detected: Startup Folder File Write
Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6268, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()", CommandLine: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6084, ParentProcessName: cmd.exe, ProcessCommandLine: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()", ProcessId: 6268, ProcessName: powershell.exe

Persistence and Installation Behavior

barindex
Sigma detected: Powershell create lnk in startup
Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"", CommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" , ParentImage: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe, ParentProcessId: 6484, ParentProcessName: Slax.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"", ProcessId: 6084, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: G4fDWS1Fpd.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\c0a9b0da-fe7b-568f-ba03-753b28d39f41Jump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Programs\Slax\LICENSE.electron.txtJump to behavior
Source: G4fDWS1Fpd.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: ffmpeg.dll.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.2341432078.000000000505C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.2340066378.000000000505E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vulkan-1.dll.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.2326442475.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2331049562.0000000005C50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2326221430.0000000004D50000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdbGCTL source: G4fDWS1Fpd.exe, 00000000.00000003.2340066378.000000000505E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: electron.exe.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.2336144347.00000000073D3000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vk_swiftshader.dll.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.2331630616.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2402706422.0000000005062000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resourcesJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\localesJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpackedJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-listJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpacked\node_modulesJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendorJump to behavior
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: * **Google Hangouts Video**: http://www.youtube.com/watch?v=I9nDOSGfwZg equals www.youtube.com (Youtube)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1423136
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1423136dumpTranslatedShadersWrite
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/342316794
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/345244067
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/355034686
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/355645824
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/355645824Frontend
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096371
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096371expandIntegerPowExpressionsThe
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096454
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096464
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096480
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096530
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096539
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096601
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096608
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096608allowES3OnFL100Allow
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096643
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096648
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096661
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096758
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096838
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096838cacheCompiledShaderEnable
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644593
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644627
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644627skipVSConstantRegisterZeroIn
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644663
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644715
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644730
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644740
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644747
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644776
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644912
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644912enableTranslatedShaderSubstitutionCheck
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/41488637
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/41493495
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42260492
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42260591
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42260722
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261226
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261713
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261756
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261881
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261882
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261924
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261924allowClearForRobustResourceInitSome
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262115
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262161
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262166
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262239
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262247
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262249
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262258
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262286
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262287
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262386
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262476
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262506
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262605
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262955
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263010
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263031
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263049
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263158
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263239
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263322
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263407
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263477
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263580
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263580disableDrawBuffersIndexedDisable
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263622
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263629
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263911
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263914
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263960
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263969
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264008
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264071
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264193
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264193forceGlErrorCheckingForce
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264287
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264287forceRobustResourceInitForce-enable
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264422
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264443
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264446
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264571
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264571forceInitShaderVariablesForce-enable
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264577
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264669
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264767
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264951
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265147
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265186
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265248
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265353
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265369
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265370
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265407
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265429
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265509
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265509dumpShaderSourceWrite
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265516
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265647
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265841
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265878
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265957
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265995
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266019
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266021
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266024
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266194
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266194disableAnisotropicFilteringDisable
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266231
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266231enableShaderSubstitutionCheck
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266232
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266232disableProgramCachingDisables
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266602
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266610
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266652
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266666
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266725
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266842
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266842uncurrentEglSurfaceUponSurfaceDestroyMake
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266906
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266976
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267038
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267045
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267057
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267082
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267082ProgramGL::postLinkJobImpl
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267095
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267113
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://blog.izs.me/)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cldr.unicode.org/index/downloads
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/python-gflags/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/smhasher/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1094869
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/110263
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1144207
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1171371
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1181068
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1181193
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1420130
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1434317
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1456243
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/308366
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/350528343
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/403957
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/550292
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/565179
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/642227
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/642605
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/644669
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/650547
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/672380
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/709351
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/797243
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/809422
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/830046
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/883276
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/927470
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/941620
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://feross.org
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://git.linuxtv.org/v4l-utils.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/troygoode/)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.github.io/snappy/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://issuetracker.google.com/200067929
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://n8.io/)
Source: G4fDWS1Fpd.exe, 00000000.00000000.2135451567.000000000040A000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://opensource.perlig.de/rjsmin/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://skbug.com/9491
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://source.android.com/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://source.android.com/compatibility)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/a/1068308/13216
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://substack.net
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://travis-ci.org/troygoode/node-require-directory)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2331630616.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/legal/guidelinesfor3rdparties.html.
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ecma-international.org/memento/codeofconduct.htm
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.finesse.demon.co.uk/steven/sqrt.html.
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.freedesktop.org/wiki/Software/xdg-user-dirs
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.futurealoof.com)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gutenberg.org/ebooks/53).
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.linux-usb.org/usb-ids.html
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/MPL/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.apple.com/apsl/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/bsd-license.php
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pertinentdetail.org/sqrt
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ploscompbiol.org/static/license
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.polymer-project.org
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.portaudio.com
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.softsynth.com
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.unicode.org/copyright.html
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.webrtc.org
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/watch?v=I9nDOSGfwZg
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zlib.net/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://android.googlesource.com/platform/external/puffin
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/360031000
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/40096376
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/40096712
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/40644738
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/40644850
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/41488638
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42263273
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42263540
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42263702
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42264072
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42264383
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265636
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265637
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265720
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265720enableCaptureLimitsSet
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265782
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265792
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265794
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265839
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265854
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265877
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265958
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266070
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266183
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266319
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266364
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266740
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266745
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266748
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266811
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266842
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42267038
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42267098
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/8646
Source: G4fDWS1Fpd.exe, 00000000.00000003.2404049137.0000000004E11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=ca&category=theme81https://myactivity.google.com/myactivity/?u
Source: G4fDWS1Fpd.exe, 00000000.00000003.2404049137.0000000004E11000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2403150196.0000000006052000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2402965121.0000000006051000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2403525597.0000000006052000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2403328482.0000000006052000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2336144347.00000000073D3000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/external/github.com/intel/tinycbor.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/vulkan-deps/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/webm/libwebm
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/webm/libwebp
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://code.google.com/p/v8/wiki/JavaScriptStackTraceApi
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1042393
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1046462
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1060012
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1091824
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1137851
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1300575
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1356053
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/40279678
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/40488750
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/593024
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/593024selectViewInGeometryShaderThe
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/650547
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/650547callClearTwiceUsing
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/655534
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/655534useSystemMemoryForConstantBuffersCopying
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/705865
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/710443
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/811661
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/848952
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://creativecommons.org/licenses/by/3.0/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/includes
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/startsWith
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/android/guides/setup
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/d/17aTgLnjMXIrfjgNaTUnHQO7m3xgzHR2VXBTmi03Qii4/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://feross.org
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://feross.org/opensource
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://feross.org/support
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Cyan4973/xxHash
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/GoogleChrome/web-vitals
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/GoogleChromeLabs/text-fragments-polyfill
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/Vulkan-Headers
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/Vulkan-Loader
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Maratyszcza/pthreadpool
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Nicoshev/rapidhash
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Nicoshev/rapidhash/blob/master/rapidhash.h
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/PortAudio/portaudio/tree/master/src/common
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ReactiveX/rxjs
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/RyanZim/universalify#readme
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/RyanZim/universalify.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Sebmaster/tr46.js#readme
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Sebmaster/tr46.js.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/SeleniumHQ/selenium/tree/trunk
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Squirrel/Squirrel.Mac
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/TooTallNate/util-deprecate
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/TroyGoode)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/WebAssembly/wasm-c-api/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/aawc/unrar.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/brailcom/speechd
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/brycebaril/node-stream-meter.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/calvinmetcalf/process-nextick-args
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/calvinmetcalf/process-nextick-args.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/conventional-changelog/standard-version):
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/dominictarr/rc.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/dpranke/typ.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/etingof/pyasn1
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/zstd
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/queue-microtask
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/run-parallel
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/safe-buffer
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/simple-concat
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/simple-get
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/flutter/flutter/issues/47164
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/flutter/flutter/issues/47804
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/diff-match-patch/tree/master/javascript
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/distributed_point_functions
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/google-api-cpp-client/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/pprof/tree/master/proto
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/private-join-and-compute
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/protobuf
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/re2
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/ruy
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/securemessage
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/sentencepiece
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/shell-encryption
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/ukey2
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/wicked-good-xpath
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/woff2
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/wuffs-mirror-release-c
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/xnnpack
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-core-module
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-core-module.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/node-supports-preserve-symlinks-flag#readme
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/node-supports-preserve-symlinks-flag.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/intel/libva
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/101)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/102)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/105)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/106
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/99)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/labels/wg-agenda
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068737927
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068738228
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068738548
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068742592
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639071916
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639072106
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639072371
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639072571
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyent/node
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jprichardson/node-fs-extra
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jprichardson/node-fs-extra/issues/269
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jrmuizel/qcms/tree/v4
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/lgeiger/node-abi/issues/54
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/libuv/libuv/pull/1088
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2331630616.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2331630616.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/pump
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-fs
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-fs.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-stream
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-stream.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mcollina/reusify#readme
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mcollina/reusify.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/micromatch/to-regex-range
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mikeal/tunnel-agent
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/TSC/blob/master/Moderation-Policy.md
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/blob/master/CODE_OF_CONDUCT.md
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/blob/v10.8.0/lib/internal/errors.js
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/8987
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/string_decoder
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/normalize/mz
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/cli/blob/4c65cd952bc8627811735bea76b9b110cc4fc80e/lib/utils/ansi-trim.js
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-semver.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-tar/blob/51b6627a1f357d2eb433e7378e5f05e83b7aa6cd/lib/header.js#L349
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/patrickhulce/third-party-web
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/prebuild/prebuild-install
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/prebuild/prebuild-install.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/protocolbuffers/protobuf-javascript
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/protocolbuffers/protobuf/blob/master/java/lite.md
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/puppeteer/puppeteer/tree/main/packages/puppeteer-core
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sass/node-sass/issues/1589#issuecomment-265292579
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/simplejson/simplejson
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/make-dir
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/os-homedir/blob/11e089f4754db38bb535e5a8416320c4446e8cfd/index.js
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/broofa
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/ctavan
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/feross
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/ljharb
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/models
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/tensorflow
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/text.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/tflite-support
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/test262-utils/test262-harness-py
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/troygoode/node-require-directory/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/v8/v8/blob/6.0.122/test/mjsunit/fast-prototype.js#L48-L63
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068735040
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068735307
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068735697
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068736093
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068736404
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638965835
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638965968
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638966056
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638966247
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638966552
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615021
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615173
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615423
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615557
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615807
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/888438143
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/888438190
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/888438236
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/918633749
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/releases/download/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/wasdk/wasmparser
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/xiph/rnnoise
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs#supported-nodejs-versions
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs-parser#supported-nodejs-versions
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs-parser.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/zeux/volk
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/zorkow/speech-rule-user
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gitlab.freedesktop.org/xorg/proto/xproto/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://hackerone.com/reports/541502
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hg.mozilla.org/mozilla-central/file/tip/netwerk/base/nsURLParsers.cpp
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/155487768
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/161903006
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/166809097
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/184850002
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/187425444
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/220069903
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/220069903emulatePixelLocalStorageEmulate
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/229267970
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/250706693
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/253522366
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/255411748
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/258207403
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/274859104
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/284462263
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/288119108
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/292282210
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/292285899
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/292285899forceMinimumMaxVertexAttributesForce
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/309028728
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/311022968
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/328301788
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/328837151
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/336844257
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/347601787
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/349489248
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/349489248rejectWebglShadersWithUndefinedBehaviorAttempts
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://medium.com/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodei.co/npm/require-directory.png?downloads=true&stars=true)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodei.co/npm/require-directory/)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2331630616.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/api/fs.html#fs_stat_time_values)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/dist
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://npmjs.org/package/require-directory))
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://opensource.apple.com/source/xnu/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2404049137.0000000004E11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://passwords.google.comCompte
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://polymer-library.polymer-project.org
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/pyparsing
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/six/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.python.org/pypi/pyfakefs
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.python.org/pypi/webapp2
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://quiche.googlesource.com/quiche
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://redux.js.org/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://secure.travis-ci.org/troygoode/node-require-directory.png)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://semver.org/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://shorturl.at/drFY7)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/site/gaviotachessuser/Home/endgame-tablebases-1
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sizzlejs.com/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://skia.org/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://source.chromium.org/chromium/chromium/src/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://source.corp.google.com/piper///depot/google3/third_party/tamachiyomi/README.md
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sourceforge.net/projects/wtl/files/WTL%2010/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sqlite.org/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2404049137.0000000004E11000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2403150196.0000000006052000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2403688819.0000000004E11000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2402965121.0000000006051000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2403525597.0000000006052000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2403328482.0000000006052000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: G4fDWS1Fpd.exe, 00000000.00000003.2404049137.0000000004E11000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2403150196.0000000006052000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2403688819.0000000004E11000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2402965121.0000000006051000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2403525597.0000000006052000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2403328482.0000000006052000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swiftshader.googlesource.com/SwiftShader
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/security
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/security).
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tukaani.org/xz/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tukaani.org/xz/>.
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/intent/user?screen_name=troygoode)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://unpkg.com/cliui
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://unpkg.com/yargs-parser
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://v8.dev/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webkit.org/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.chromium.org
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.khronos.org/registry/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.khronos.org/spir/visualizer/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/wrap-ansi
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.opensource.org/licenses/bsd-license.php)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.patreon.com/feross
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.unicode.org/copyright.html.
Source: G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yargs.js.org/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://zod.dev
Source: G4fDWS1Fpd.exe, 00000000.00000003.2336144347.00000000073D3000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: GetRawInputDatamemstr_2ea72a27-1

System Summary

barindex
Drops large PE files
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile dump: Slax.exe.0.dr 188703744Jump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile dump: Slax.exe0.0.dr 188703744Jump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeProcess token adjusted: SecurityJump to behavior
Source: G4fDWS1Fpd.exeStatic PE information: invalid certificate
Source: Slax.exe.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: Slax.exe0.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: Slax.exe.0.drStatic PE information: Number of sections : 15 > 10
Source: Slax.exe0.0.drStatic PE information: Number of sections : 15 > 10
Source: G4fDWS1Fpd.exe, 00000000.00000003.2353347051.000000000525E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename* vs G4fDWS1Fpd.exe
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dllb! vs G4fDWS1Fpd.exe
Source: G4fDWS1Fpd.exe, 00000000.00000003.2340066378.000000000505E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs G4fDWS1Fpd.exe
Source: G4fDWS1Fpd.exe, 00000000.00000003.2226212005.0000000006976000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs G4fDWS1Fpd.exe
Source: G4fDWS1Fpd.exe, 00000000.00000003.2331630616.0000000006950000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevk_swiftshader.dll, vs G4fDWS1Fpd.exe
Source: G4fDWS1Fpd.exe, 00000000.00000003.2402706422.0000000005062000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevk_swiftshader.dll, vs G4fDWS1Fpd.exe
Source: G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dllb! vs G4fDWS1Fpd.exe
Source: G4fDWS1Fpd.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: mal60.spre.winEXE@28/106@0/0
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeMutant created: \Sessions\1\BaseNamedObjects\mfx_d3d_mutex
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6512:120:WilError_03
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeMutant created: \Sessions\1\BaseNamedObjects\c0a9b0da-fe7b-568f-ba03-753b28d39f41
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2548:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5872:120:WilError_03
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsb1CDB.tmpJump to behavior
Source: G4fDWS1Fpd.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SLAX.EXE'
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: G4fDWS1Fpd.exe, 00000000.00000003.2333927085.00000000071E8000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT name FROM sqlite_master WHERE type='table';
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile read: C:\Users\user\Desktop\G4fDWS1Fpd.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\G4fDWS1Fpd.exe "C:\Users\user\Desktop\G4fDWS1Fpd.exe"
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Slax.exe" /FO csv | "C:\Windows\system32\find.exe" "Slax.exe"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Slax.exe" /FO csv
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe "C:\Windows\system32\find.exe" "Slax.exe"
Source: unknownProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe"
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1816,i,11646247368897797242,13434058048070250299,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2584,i,11646247368897797242,13434058048070250299,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:3
Source: unknownProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe"
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()""
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1864,i,400091264659153544,17151257105363730347,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2392,i,400091264659153544,17151257105363730347,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Slax.exe" /FO csv | "C:\Windows\system32\find.exe" "Slax.exe"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Slax.exe" /FO csv Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe "C:\Windows\system32\find.exe" "Slax.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1816,i,11646247368897797242,13434058048070250299,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2584,i,11646247368897797242,13434058048070250299,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:3Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1864,i,400091264659153544,17151257105363730347,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2392,i,400091264659153544,17151257105363730347,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: iconcodecservice.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dllJump to behavior
Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mscms.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: coloradapterclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mmdevapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: devobj.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: duser.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: xmllite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: atlthunk.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mf.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mfplat.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: rtworkq.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mmdevapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: devobj.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mscms.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: coloradapterclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mf.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mfplat.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: rtworkq.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mpr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: scrrun.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Slax.exe" /FO csv
Source: MyElectronApp.lnk.13.drLNK file: ..\..\..\..\..\..\Local\Programs\Slax\Slax.exe
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\c0a9b0da-fe7b-568f-ba03-753b28d39f41Jump to behavior
Source: G4fDWS1Fpd.exeStatic file information: File size 86638456 > 1048576
Source: G4fDWS1Fpd.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: ffmpeg.dll.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.2341432078.000000000505C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.2340066378.000000000505E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vulkan-1.dll.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.2326442475.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2331049562.0000000005C50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2326221430.0000000004D50000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdbGCTL source: G4fDWS1Fpd.exe, 00000000.00000003.2340066378.000000000505E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: electron.exe.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.2336144347.00000000073D3000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vk_swiftshader.dll.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.2331630616.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2402706422.0000000005062000.00000004.00000020.00020000.00000000.sdmp
Source: ffmpeg.dll.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll.0.drStatic PE information: section name: _RDATA
Source: libEGL.dll.0.drStatic PE information: section name: .gxfg
Source: libEGL.dll.0.drStatic PE information: section name: .retplne
Source: libEGL.dll.0.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll.0.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll.0.drStatic PE information: section name: .retplne
Source: libGLESv2.dll.0.drStatic PE information: section name: _RDATA
Source: Slax.exe.0.drStatic PE information: section name: .gxfg
Source: Slax.exe.0.drStatic PE information: section name: .retplne
Source: Slax.exe.0.drStatic PE information: section name: .rodata
Source: Slax.exe.0.drStatic PE information: section name: CPADinfo
Source: Slax.exe.0.drStatic PE information: section name: LZMADEC
Source: Slax.exe.0.drStatic PE information: section name: _RDATA
Source: Slax.exe.0.drStatic PE information: section name: malloc_h
Source: Slax.exe.0.drStatic PE information: section name: prot
Source: ffmpeg.dll0.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll0.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll0.0.drStatic PE information: section name: _RDATA
Source: libEGL.dll0.0.drStatic PE information: section name: .gxfg
Source: libEGL.dll0.0.drStatic PE information: section name: .retplne
Source: libEGL.dll0.0.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll0.0.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll0.0.drStatic PE information: section name: .retplne
Source: libGLESv2.dll0.0.drStatic PE information: section name: _RDATA
Source: fastlist-0.3.0-x64.exe.0.drStatic PE information: section name: _RDATA
Source: Slax.exe0.0.drStatic PE information: section name: .gxfg
Source: Slax.exe0.0.drStatic PE information: section name: .retplne
Source: Slax.exe0.0.drStatic PE information: section name: .rodata
Source: Slax.exe0.0.drStatic PE information: section name: CPADinfo
Source: Slax.exe0.0.drStatic PE information: section name: LZMADEC
Source: Slax.exe0.0.drStatic PE information: section name: _RDATA
Source: Slax.exe0.0.drStatic PE information: section name: malloc_h
Source: Slax.exe0.0.drStatic PE information: section name: prot
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .retplne
Source: vk_swiftshader.dll.0.drStatic PE information: section name: _RDATA
Source: vulkan-1.dll.0.drStatic PE information: section name: .gxfg
Source: vulkan-1.dll.0.drStatic PE information: section name: .retplne
Source: vulkan-1.dll.0.drStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exeJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\nsExec.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Programs\Slax\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\Slax.exeJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Programs\Slax\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Programs\Slax\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Programs\Slax\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exeJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\SpiderBanner.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Programs\Slax\LICENSE.electron.txtJump to behavior

Boot Survival

barindex
Powershell creates an autostart link
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: .lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell user required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module via navigations and search. Tags = @('powershell','unit testing','bdd','tdd','mocking') # The web address of an icon which can be us
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: .lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell user required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module via navigations and search. Tags = @('powershell','unit testing','bdd','tdd','mocking') # The web address of an icon which can be us
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnkJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnkJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3389Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3720Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3987
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exeJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\nsExec.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Slax\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Slax\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Slax\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exeJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\SpiderBanner.dllJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3384Thread sleep count: 3389 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5532Thread sleep count: 3720 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6520Thread sleep time: -4611686018427385s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3564Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5768Thread sleep count: 3987 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2084Thread sleep count: 233 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6312Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5168Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resourcesJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\localesJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpackedJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-listJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpacked\node_modulesJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendorJump to behavior
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMware
Source: G4fDWS1Fpd.exe, 00000000.00000003.2333927085.0000000006E90000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: bCK1sK9IRQq9qEmUv4RDsNuESgMjGWdqb8FuvAY5N9GIIvejQjBAMA8GA1UdEwEB/wQFMAMB
Source: G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSDKVersion() < 27 && IsAdreno5xxOrOlder(functions)) || (!isMesa && IsMaliT8xxOrOlder(functions)) || (!isMesa && IsMaliG31OrOlder(functions))
Source: G4fDWS1Fpd.exe, 00000000.00000003.2403688819.0000000004E52000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Prod_VMware_SATA_CD00#4&224f42ef
Source: G4fDWS1Fpd.exe, 00000000.00000003.2341432078.000000000505C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tgaR
Source: G4fDWS1Fpd.exe, 00000000.00000003.2333927085.0000000006E90000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: G4fDWS1Fpd.exe, 00000000.00000003.2341432078.000000000505C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Screen Codec / VMware Video
Source: G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ZAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTestp
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Slax.exe" /FO csv | "C:\Windows\system32\find.exe" "Slax.exe"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Slax.exe" /FO csv Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe "C:\Windows\system32\find.exe" "Slax.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1816,i,11646247368897797242,13434058048070250299,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2584,i,11646247368897797242,13434058048070250299,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:3Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1864,i,400091264659153544,17151257105363730347,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2392,i,400091264659153544,17151257105363730347,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\slax" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1816,i,11646247368897797242,13434058048070250299,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\slax\slax.exe';$s.save()""
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\slax" --field-trial-handle=2584,i,11646247368897797242,13434058048070250299,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\slax\slax.exe';$s.save()""
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\slax" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1864,i,400091264659153544,17151257105363730347,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\slax" --field-trial-handle=2392,i,400091264659153544,17151257105363730347,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\slax" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1816,i,11646247368897797242,13434058048070250299,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\slax\slax.exe';$s.save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\slax" --field-trial-handle=2584,i,11646247368897797242,13434058048070250299,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\slax\slax.exe';$s.save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\slax" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1864,i,400091264659153544,17151257105363730347,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\slax" --field-trial-handle=2392,i,400091264659153544,17151257105363730347,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3Jump to behavior
Source: G4fDWS1Fpd.exe, 00000000.00000003.2333927085.0000000006E90000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ..\..\third_party\webrtc\modules\desktop_capture\win\window_capture_utils.ccFail to create instance of VirtualDesktopManagerChrome_WidgetWin_Progman..\..\third_party\webrtc\modules\desktop_capture\cropping_window_capturer.ccWindow no longer on top when ScreenCapturer finishesScreenCapturer failed to capture a frameWindow rect is emptyWindow is outside of the captured displaySysShadowWebRTC.DesktopCapture.Win.WindowGdiCapturerFrameTime..\..\third_party\webrtc\modules\desktop_capture\win\window_capturer_win_gdi.ccWindow hasn't been selected: Target window has been closed.Failed to get drawable window area: Failed to get window DC: Failed to create frame.Both PrintWindow() and BitBlt() failed.Capturing owned window failed (previous error/warning pertained to that)WindowCapturerWinGdi::CaptureFrameWebRTC.DesktopCapture.BlankFrameDetectedWebRTC.DesktopCapture.PrimaryCapturerSelectSourceErrorWebRTC.DesktopCapture.PrimaryCapturerErrorWebRTC.DesktopCapture.PrimaryCapturerPermanentErrordwmapi.dllDwmEnableComposition..\..\third_party\webrtc\modules\desktop_capture\win\screen_capturer_win_gdi.ccFailed to capture screen by GDI.WebRTC.DesktopCapture.Win.ScreenGdiCapturerFrameTimedesktop_dc_memory_dc_Failed to get screen rect.Failed to create frame buffer.Failed to select current bitmap into memery dc.BitBlt failedScreenCapturerWinGdi::CaptureFrame..\..\third_party\webrtc\modules\desktop_capture\win\cursor.ccwebrtc::CreateMouseCursorFromHCursorUnable to get cursor icon info. Error = Unable to get bitmap info. Error = Unable to get bitmap bits. Error = `
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users\user\AppData\Local VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users\user VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users\user\AppData VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users\user\AppData\Local VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users\user\AppData\Local\Programs VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Slax VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Slax\resources\app.asar VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users\user\AppData\Roaming\Slax\Local State VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users\user\AppData\Roaming\Slax\config.json VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users\user\AppData\Roaming\Slax\config.json VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Windows Management Instrumentation		1
Windows Service		1
Windows Service		1
Masquerading		11
Input Capture		1
Security Software Discovery		Remote Services11
Input Capture		Data ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Command and Scripting Interpreter		12
Registry Run Keys / Startup Folder		12
Process Injection		21
Virtualization/Sandbox Evasion		LSASS Memory3
Process Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
PowerShell		1
DLL Side-Loading		12
Registry Run Keys / Startup Folder		12
Process Injection		Security Account Manager21
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
DLL Side-Loading		1
DLL Side-Loading		NTDS1
Application Window Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets1
Remote System Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials2
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync34
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1556260 Sample: G4fDWS1Fpd.exe Startdate: 15/11/2024 Architecture: WINDOWS Score: 60 55 Sigma detected: Powershell create lnk in startup 2->55 57 Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE 2->57 7 G4fDWS1Fpd.exe 11 226 2->7         started        11 Slax.exe 4 2->11         started        13 Slax.exe 1 2->13         started        process3 file4 47 C:\Users\user\AppData\Local\...\Slax.exe, PE32+ 7->47 dropped 49 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 7->49 dropped 51 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 7->51 dropped 53 17 other files (none is malicious) 7->53 dropped 61 Drops large PE files 7->61 15 cmd.exe 1 7->15         started        17 cmd.exe 1 11->17         started        19 Slax.exe 1 11->19         started        21 Slax.exe 1 11->21         started        23 cmd.exe 13->23         started        25 Slax.exe 1 13->25         started        27 Slax.exe 1 13->27         started        signatures5 process6 process7 29 conhost.exe 15->29         started        31 tasklist.exe 1 15->31         started        33 find.exe 1 15->33         started        35 powershell.exe 17 17->35         started        39 conhost.exe 17->39         started        41 conhost.exe 23->41         started        43 powershell.exe 23->43         started        file8 45 C:\Users\user\AppData\...\MyElectronApp.lnk, MS 35->45 dropped 59 Powershell creates an autostart link 35->59 signatures9

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
G4fDWS1Fpd.exe0%VirustotalBrowse
G4fDWS1Fpd.exe0%ReversingLabs

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Programs\Slax\Slax.exe0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Slax\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Slax\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Slax\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Slax\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\Slax.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\elevate.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\vulkan-1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\SpiderBanner.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\StdUtils.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\nsExec.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\nsis7z.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://anglebug.com/422622860%Avira URL Cloudsafe
http://anglebug.com/422621610%Avira URL Cloudsafe
https://anglebug.com/422657920%Avira URL Cloudsafe
https://anglebug.com/422657940%Avira URL Cloudsafe
http://anglebug.com/422630100%Avira URL Cloudsafe
https://anglebug.com/422657941%VirustotalBrowse
http://anglebug.com/422621660%Avira URL Cloudsafe
http://anglebug.com/422622870%Avira URL Cloudsafe
https://secure.travis-ci.org/troygoode/node-require-directory.png)0%Avira URL Cloudsafe
https://anglebug.com/422657820%Avira URL Cloudsafe
https://yargs.js.org/0%Avira URL Cloudsafe
http://anglebug.com/422622861%VirustotalBrowse
http://anglebug.com/42264571forceInitShaderVariablesForce-enable0%Avira URL Cloudsafe
http://anglebug.com/422666520%Avira URL Cloudsafe
http://anglebug.com/422630310%Avira URL Cloudsafe
https://nodei.co/npm/require-directory/)0%Avira URL Cloudsafe
http://anglebug.com/422666660%Avira URL Cloudsafe
http://anglebug.com/42263580disableDrawBuffersIndexedDisable0%Avira URL Cloudsafe
http://anglebug.com/422631580%Avira URL Cloudsafe
http://anglebug.com/42266842uncurrentEglSurfaceUponSurfaceDestroyMake0%Avira URL Cloudsafe
http://anglebug.com/422630490%Avira URL Cloudsafe
https://tukaani.org/xz/&gt;.0%Avira URL Cloudsafe
http://anglebug.com/422622490%Avira URL Cloudsafe
http://anglebug.com/422646690%Avira URL Cloudsafe
http://anglebug.com/422655160%Avira URL Cloudsafe
https://anglebug.com/422656360%Avira URL Cloudsafe
https://anglebug.com/422656370%Avira URL Cloudsafe
https://issuetracker.google.com/3476017870%Avira URL Cloudsafe
https://anglebug.com/422668420%Avira URL Cloudsafe
http://anglebug.com/422668420%Avira URL Cloudsafe
http://anglebug.com/422644220%Avira URL Cloudsafe
http://anglebug.com/422667250%Avira URL Cloudsafe
http://anglebug.com/422622470%Avira URL Cloudsafe
http://anglebug.com/422658780%Avira URL Cloudsafe
http://anglebug.com/422666020%Avira URL Cloudsafe
http://anglebug.com/422654070%Avira URL Cloudsafe
http://anglebug.com/42266232disableProgramCachingDisables0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://github.com/lgeiger/node-abi/issues/54G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
    		high
    https://github.com/mcollina/reusify#readmeG4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
      		high
      https://github.com/simplejson/simplejsonG4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpfalse
        		high
        https://support.google.com/chrome/answer/6098869G4fDWS1Fpd.exe, 00000000.00000003.2404049137.0000000004E11000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2403150196.0000000006052000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2403688819.0000000004E11000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2402965121.0000000006051000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2403525597.0000000006052000.00000004.00000020.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2403328482.0000000006052000.00000004.00000020.00020000.00000000.sdmpfalse
          		high
          http://anglebug.com/40096661G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            https://github.com/prebuild/prebuild-installG4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
              		high
              https://github.com/vercel/pkg-fetch/actions/runs/2638965835G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                https://github.com/jesec/pkg-fetch/actions/runs/2639072106G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                  		high
                  http://anglebug.com/42262161G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://anglebug.com/42265794G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                  • 1%, Virustotal, Browse
                  • Avira URL Cloud: safe
                  		unknown
                  https://github.com/feross/queue-microtaskG4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                    		high
                    http://anglebug.com/42263010G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://anglebug.com/42265792G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://anglebug.com/42262286G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                    • 1%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown
                    https://github.com/nodejs/string_decoderG4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                      		high
                      http://anglebug.com/42262166G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://anglebug.com/42262287G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://crbug.com/1356053G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://secure.travis-ci.org/troygoode/node-require-directory.png)G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://www.patreon.com/ferossG4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          http://crbug.com/110263G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://github.com/vercel/pkg-fetch/actions/runs/2638965968G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              https://anglebug.com/42265782G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              https://yargs.js.org/G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              https://semver.org/G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                		high
                                https://github.com/google/pprof/tree/master/protoG4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  http://anglebug.com/42264571forceInitShaderVariablesForce-enableG4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://anglebug.com/42266652G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://github.com/jrmuizel/qcms/tree/v4G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://npmjs.org/package/require-directory))G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		high
                                      https://chromium.googlesource.com/chromium/src/G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2336144347.00000000073D3000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://crbug.com/593024G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://anglebug.com/42266748G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://github.com/tensorflow/modelsG4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://anglebug.com/42266745G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://github.com/KhronosGroup/SPIRV-Headers.gitG4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://anglebug.com/42266740G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://anglebug.com/42263031G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://issuetracker.google.com/161903006G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://nodei.co/npm/require-directory/)G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://crbug.com/1300575G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://anglebug.com/42266666G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://crbug.com/710443G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWithG4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://anglebug.com/42263158G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://github.com/tensorflow/tflite-supportG4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://anglebug.com/42264008G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://pypi.org/project/pyparsingG4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://sqlite.org/G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://code.google.com/p/v8/wiki/JavaScriptStackTraceApiG4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://crbug.com/1060012G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://www.opensource.org/licenses/mit-license.php)G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://anglebug.com/42263580disableDrawBuffersIndexedDisableG4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          http://stackoverflow.com/a/1068308/13216G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://github.com/jesec/pkg-fetch/actions/runs/2639072371G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://crbug.com/642605G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://twitter.com/intent/user?screen_name=troygoode)G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://anglebug.com/40096454G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://anglebug.com/42266842uncurrentEglSurfaceUponSurfaceDestroyMakeG4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    https://github.com/libuv/libuv/pull/1088G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://tukaani.org/xz/&gt;.G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://sizzlejs.com/G4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://anglebug.com/345244067G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://anglebug.com/42263049G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown
                                                                                          http://anglebug.com/40644663G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://crbug.com/650547callClearTwiceUsingG4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://anglebug.com/42262249G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://medium.com/G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://anglebug.com/42264669G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                http://anglebug.com/42265516G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                http://crbug.com/1420130G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://www.portaudio.comG4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://www.unicode.org/copyright.htmlG4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://anglebug.com/42265636G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      https://github.com/inspect-js/node-supports-preserve-symlinks-flag.gitG4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://github.com/vercel/pkg-fetch/actions/runs/2068735040G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://anglebug.com/42265637G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          • Avira URL Cloud: safe
                                                                                                          		unknown
                                                                                                          https://anglebug.com/42265877G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://issuetracker.google.com/347601787G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            • Avira URL Cloud: safe
                                                                                                            		unknown
                                                                                                            https://anglebug.com/42266842G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            • Avira URL Cloud: safe
                                                                                                            		unknown
                                                                                                            https://github.com/vercel/pkg-fetch/actions/runs/752615557G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://github.com/RyanZim/universalify.gitG4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://github.com/google/shell-encryptionG4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://anglebug.com/42266842G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                  • Avira URL Cloud: safe
                                                                                                                  		unknown
                                                                                                                  http://anglebug.com/42264422G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                  • Avira URL Cloud: safe
                                                                                                                  		unknown
                                                                                                                  http://anglebug.com/42265995G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://github.com/wasdk/wasmparserG4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://passwords.google.comCompteG4fDWS1Fpd.exe, 00000000.00000003.2404049137.0000000004E11000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://anglebug.com/42266725G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                        • Avira URL Cloud: safe
                                                                                                                        		unknown
                                                                                                                        http://anglebug.com/42262247G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                        • Avira URL Cloud: safe
                                                                                                                        		unknown
                                                                                                                        http://anglebug.com/42265878G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                        • Avira URL Cloud: safe
                                                                                                                        		unknown
                                                                                                                        https://unpkg.com/cliuiG4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://anglebug.com/42266602G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          • Avira URL Cloud: safe
                                                                                                                          		unknown
                                                                                                                          http://anglebug.com/42265407G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          • Avira URL Cloud: safe
                                                                                                                          		unknown
                                                                                                                          https://github.com/dpranke/typ.gitG4fDWS1Fpd.exe, 00000000.00000003.2207538106.0000000005E50000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2348092293.0000000005252000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://github.com/nodejs/node/issues/8987G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://anglebug.com/42266232disableProgramCachingDisablesG4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              • Avira URL Cloud: safe
                                                                                                                              		unknown
                                                                                                                              https://issuetracker.google.com/309028728G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://github.com/vercel/pkg-fetch/actions/runs/752615423G4fDWS1Fpd.exe, 00000000.00000003.2220687206.0000000005A50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://anglebug.com/40096758G4fDWS1Fpd.exe, 00000000.00000003.2233963884.0000000006950000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2345694653.000000000525F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high

                                                                                                                                    World Map of Contacted IPs

                                                                                                                                    ⊘No contacted IP infos

                                                                                                                                    General Information

                                                                                                                                    Joe Sandbox version:41.0.0 Charoite
                                                                                                                                    Analysis ID:1556260
                                                                                                                                    Start date and time:2024-11-15 08:16:17 +01:00
                                                                                                                                    Joe Sandbox product:CloudBasic
                                                                                                                                    Overall analysis duration:0h 8m 36s
                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                    Report type:full
                                                                                                                                    Cookbook file name:default.jbs
                                                                                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                    Number of analysed new started processes analysed:26
                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                    Number of injected processes analysed:0
                                                                                                                                    Technologies:
                                                                                                                                    • HCA enabled
                                                                                                                                    • EGA enabled
                                                                                                                                    • AMSI enabled
                                                                                                                                    Analysis Mode:default
                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                    Sample name:G4fDWS1Fpd.exe
                                                                                                                                    renamed because original name is a hash value
                                                                                                                                    Original Sample Name:fac7f1a54eef98830ecbd25fef364695b8afd9e255dcc19702dac84ee526c5ca.exe
                                                                                                                                    Detection:MAL
                                                                                                                                    Classification:mal60.spre.winEXE@28/106@0/0
                                                                                                                                    EGA Information:Failed
                                                                                                                                    HCA Information:
                                                                                                                                    • Successful, ratio: 100%
                                                                                                                                    • Number of executed functions: 0
                                                                                                                                    • Number of non-executed functions: 0
                                                                                                                                    Cookbook Comments:
                                                                                                                                    • Found application associated with file extension: .exe

                                                                                                                                    Warnings

                                                                                                                                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
                                                                                                                                    • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                    • Report size getting too big, too many NtQueryVolumeInformationFile calls found.

                                                                                                                                    Simulations

                                                                                                                                    Behavior and APIs

                                                                                                                                    TimeTypeDescription
                                                                                                                                    02:17:21API Interceptor13x Sleep call for process: G4fDWS1Fpd.exe modified
                                                                                                                                    02:17:42API Interceptor13x Sleep call for process: powershell.exe modified
                                                                                                                                    08:17:47AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk

                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                    IPs

                                                                                                                                    ⊘No context

                                                                                                                                    Domains

                                                                                                                                    ⊘No context

                                                                                                                                    ASNs

                                                                                                                                    ⊘No context

                                                                                                                                    JA3 Fingerprints

                                                                                                                                    ⊘No context

                                                                                                                                    Dropped Files

                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                    C:\Users\user\AppData\Local\Programs\Slax\d3dcompiler_47.dlla2zZyepQzF.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                      kCKthbZCUf.exeGet hashmaliciousUnknownBrowse
                                                                                                                                        cMqyGFCQHk.exeGet hashmaliciousUnknownBrowse
                                                                                                                                          cMqyGFCQHk.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            Soltix.exeGet hashmaliciousUnknownBrowse
                                                                                                                                              Soltix.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                Prismifyr_Installer_v2.1 Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                  Prismifyr_Installer_v2.1 Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                    Prismifyr_Installer_v2.1 Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                      Prismifyr_Installer_v2.1 Setup 1.0.0.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                        Created / dropped Files

                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):64
                                                                                                                                                        Entropy (8bit):0.34726597513537405
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:Nlll:Nll
                                                                                                                                                        MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                                                                                                        SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                                                                                                        SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                                                                                                        SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:@...e...........................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Programs\Slax\LICENSE.electron.txt

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1096
                                                                                                                                                        Entropy (8bit):5.13006727705212
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                        MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                        SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                        SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                        SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                        C:\Users\user\AppData\Local\Programs\Slax\LICENSES.chromium.html

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:HTML document, ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):9099045
                                                                                                                                                        Entropy (8bit):4.754770173605162
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24576:2o9dQ06p6j6j1WOwRiXjYmfy6k6mjK64jK6gjK6e6cjK6feGjl8PpE:BFOeGT
                                                                                                                                                        MD5:6FF57C0AECCDF44C39C95DEE9ECEA805
                                                                                                                                                        SHA1:C76669A1354067A1C3DDBC032E66C323286A8D43
                                                                                                                                                        SHA-256:0BA4C7B781E9F149195A23D3BE0F704945F858A581871A9FEDD353F12CE839CA
                                                                                                                                                        SHA-512:D6108E1D1D52AA3199FF051C7B951025DBF51C5CB18E8920304116DCEF567367ED682245900FDA3AD354C5D50AA5A3C4E6872570A839A3A55D3A9B7579BDFA24
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

                                                                                                                                                        C:\Users\user\AppData\Local\Programs\Slax\Slax.exe

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):188703744
                                                                                                                                                        Entropy (8bit):6.7582799459614025
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:1572864:bwl41lgY+w9QLv1JWYc6UeOtUUGQUT1jdu4BPPuuwT2GOqiB1sr7zjg7ob753oUV:RF4oD0QdG09P
                                                                                                                                                        MD5:262797985453830673179336B6BACAC6
                                                                                                                                                        SHA1:E8AB15D4C8606CF1341F2CD7EF27F69145C0F372
                                                                                                                                                        SHA-256:663C85DDB2BDA40E449BFD73F2E13E8B5C007240266F1440DFC42ECE6E2D36CC
                                                                                                                                                        SHA-512:C95598F7DDC560AE9110201D354F61D8621EC8AF83E93E550DFE58B10C1DF0BE060ECDABAAB0CE4A2DCFC2B77152A044E3B824BEB4623958D388EC6A5C63D925
                                                                                                                                                        Malicious:true
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."......FH.........`IY........@.............................p~...........`..........................................d..k...0...h....`m.H.....#...H..........0o..5..P.......................0...(....}H.@............................................text...*DH......FH................. ..`.rdata.......`H......LH.............@..@.data....H......L..................@....pdata....H...#...H.................@..@.gxfg....B...pl..D....-.............@..@.retplne......l......*...................rodata.......l......,.............. ..`.tls..........l......>..............@...CPADinfo8.....m......D..............@...LZMADEC.......m......F.............. ..`_RDATA.......0m......X..............@..@malloc_h.....@m......Z.............. ..`prot.........Pm......\..............@..@.rsrc...H....`m......^..............@..@.reloc...5...0o..6....0.............@..B................

                                                                                                                                                        C:\Users\user\AppData\Local\Programs\Slax\chrome_100_percent.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):151599
                                                                                                                                                        Entropy (8bit):7.915992368779121
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
                                                                                                                                                        MD5:83EC43F2AF9FC52025F3F807B185D424
                                                                                                                                                        SHA1:EA432F7571D89DD43A76D260CB5853CADA253AA0
                                                                                                                                                        SHA-256:A659EE9EB38636F85F5336587C578FB29740D3EFFAFF9B92852C8A210E92978C
                                                                                                                                                        SHA-512:6DDCA85215BF6F7F9B17C5D52BD7395702515BC2354A8CD8FA6C1CCD7355A23B17828853CEABEEF597B5BCA11750DC7C9F6EC3C45A33C2106F816FEC74963D86
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:..........<.............h.....i.\...j.....k.I...l.....n.....o.....p.:...q.4...r.o...s.?...t..!..u..%..v.@'..w..1..x..<..y.l?..z..C..{..G..|..I..}..J..~..M.....O.....R....|V.....Z.....]....N`.....a....3c....gd.....e....@g.....g.....m....~s....Fw....&{.....~..........*.....m................8..........._...........1....V.............w....e........F.........'....Z....k....5...,.....-.h........./.....0.!...1.....6.f...7.....8..!....$....&...../.....1.....5....3:....CE.....F....(O.....U....b[.....`....g....^i.....m.....q....V{....v~..............R...............X.....#.................................................|.....S..........W...........i..........2.....`...........S...........S.....(............................s...........y.....N.....".......................&.............................................Q"....-#.....#....$....v%....?&.....&....*(.... ).....*...........2....33....3.....3.....4....5....v6.....6.....7....f7....7.....7.....>.....A....sB

                                                                                                                                                        C:\Users\user\AppData\Local\Programs\Slax\chrome_200_percent.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):228644
                                                                                                                                                        Entropy (8bit):7.946488830213853
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
                                                                                                                                                        MD5:DC48A33BD20BFC7CACFC925A84B015B6
                                                                                                                                                        SHA1:8DFEE88FD1DC77F89AD88C19146FE3AB45E43F3C
                                                                                                                                                        SHA-256:2C1B3E4B8A0CF837AE0A390FCA54F45D7D22418E040F1DFEA979622383ACCED6
                                                                                                                                                        SHA-512:1D54EB5D2BA06AF0BA8F6B491B0D43F178A48AC82CDF383BEB265E732DDFC06BCA9692003FDFCE56F7F00AF97F29ACF046C73B891B8C561610098F9626EAF05A
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:..........<.........&...h.....i.....j.....k.....l.....n.....o.|%..p..*..q..-..r.85..s..:..t..>..u.CG..v..K..w.._..x._t..y.{y..z....{.4...|....}.m...~...............................................h.............................5.................t...........-.................D............$.....-....K9.....@....FH...bL...9O...nT...)U...jV...UZ....]...s`...xc...f....j...n..,.\r..-..s....ku../..v..0..w..1.Dx..6..x..7.....8.Q............................F................S..........{...........^.....@...........!....%....&/....R2....:....>....RH....R.....V....|X....Sa.....i....k.....n.....r.....y.....{....%..........`.....7...........................................0.....I..........;.....l.....b.....B.....%.....S.....m..........L...........R..........V...........g.....)........................!.....'....-....u3.....4.....5.....6.....8....:9.....:.....<....=....`?....$L.....\....v\.....\....;].....]....._....._....K`....`.....a....]a....a.....g.....k....Rl

                                                                                                                                                        C:\Users\user\AppData\Local\Programs\Slax\d3dcompiler_47.dll

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):4916728
                                                                                                                                                        Entropy (8bit):6.398031738914566
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
                                                                                                                                                        MD5:A7B7470C347F84365FFE1B2072B4F95C
                                                                                                                                                        SHA1:57A96F6FB326BA65B7F7016242132B3F9464C7A3
                                                                                                                                                        SHA-256:AF7B99BE1B8770C0E4D18E43B04E81D11BDEB667FA6B07ADE7A88F4C5676BF9A
                                                                                                                                                        SHA-512:83391A219631F750499FD9642D59EC80FB377C378997B302D10762E83325551BB97C1086B181FFF0521B1CA933E518EAB71A44A3578A23691F215EBB1DCE463D
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Joe Sandbox View:
                                                                                                                                                        • Filename: a2zZyepQzF.exe, Detection: malicious, Browse
                                                                                                                                                        • Filename: kCKthbZCUf.exe, Detection: malicious, Browse
                                                                                                                                                        • Filename: cMqyGFCQHk.exe, Detection: malicious, Browse
                                                                                                                                                        • Filename: cMqyGFCQHk.exe, Detection: malicious, Browse
                                                                                                                                                        • Filename: Soltix.exe, Detection: malicious, Browse
                                                                                                                                                        • Filename: Soltix.exe, Detection: malicious, Browse
                                                                                                                                                        • Filename: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                        • Filename: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                        • Filename: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                        • Filename: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K......JK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Programs\Slax\ffmpeg.dll

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):2929152
                                                                                                                                                        Entropy (8bit):6.70454100720416
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:49152:ZBAnytEwrZu/3Q8rvnh2UGH6qfhtvRIdefZiC6Cry2:ZBFE6kfbrvnh21K+io
                                                                                                                                                        MD5:5A168CB3EA9D0E7400BAABF60F6AB933
                                                                                                                                                        SHA1:82A86CB7F42294AB4AD6669C19B92605D960B676
                                                                                                                                                        SHA-256:AF5F1BC9F6A73750FA0C7BF17439700CFB3AB23E1393F0C9899825417E319B54
                                                                                                                                                        SHA-512:7C1441ECD049543E38297A7B6929E9F3EB978422D0CE508FBE6350FFEBD297F947B8D9EC75BD2054142DCD8461EEF1BF110E040D0830DA977FDE8944BECE843D
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......#...................................................:...........`A..........................................*.......*.(.............9..............:.<5....*.......................*.(.....$.@...........H.*.8............................text.....#.......#................. ..`.rdata........$.......#.............@..@.data.........+.."....+.............@....pdata.......9.......+.............@..@.gxfg....+...0:..,...J,.............@..@.retplne.....`:......v,..................tls.........p:......x,.............@..._RDATA........:......z,.............@..@.reloc..<5....:..6...|,.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Programs\Slax\icudtl.dat

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):10468208
                                                                                                                                                        Entropy (8bit):6.265606239082294
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
                                                                                                                                                        MD5:FFD67C1E24CB35DC109A24024B1BA7EC
                                                                                                                                                        SHA1:99F545BC396878C7A53E98A79017D9531AF7C1F5
                                                                                                                                                        SHA-256:9AE98C06CBB0EA43C5CD6B5725310C008C65E46072421A1118CB88E1DE9A8B92
                                                                                                                                                        SHA-512:E1A865E685D2D3BACD0916D4238A79462519D887FEB273A251120BB6AF2B4481D025F3B21CE9A1A95A49371A0AA3ECF072175BA756974E831DBFDE1F0FEAEB79
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E...(...E...)...F...).."F...1..5F..`1..EF...N..XF..PN..hF...N..xF.......F.......F.......F..@....F.......F......F..0....F.......G......$G......7G......JG......]G..@...pG.......G.......G..@....G.......G.......G..@....G.......G..p....H..`....H.......H..@...AH......TH..p...gH.....zH.......H..`....H.......H.......H..P....H.......H......H..`....I......%I..P...:I......RI.....bI..@...uI.......I.......I.......I..P....I.......I.......I..0....I.......J... ...J.. !..-J..@$..=J...$..PJ...$..qJ.......J...<...J....&..J....&..J.. .&..J....&..K..`.&..K....&.3K....&.JK..0.&.aK....'.xK....'..K....'..K...(..K....(..K...O)..K....)..L..0Q*.>L..`.*.gL..Pi+..L....+..L...i,..L....,..L..P}-..M..@.-.,M.. .-.EM....-.\M....-.uM....-..M...$...M..0%...M....0..M...j0..M..`.0..N..p.0.1N....0.AN....0.TN..@.0.iN....0..N..0.0..N....0..N....0..N....1..N....1..N..

                                                                                                                                                        C:\Users\user\AppData\Local\Programs\Slax\libEGL.dll

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):493056
                                                                                                                                                        Entropy (8bit):6.3672588781107775
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:0PfRujpqWG9btH+M1wLPfj9iDcHetGsHUN0dxI2H6sNkD4Fvh2W:eAWt+MWLPfjkVGbN0dxI2H63D4Bh2
                                                                                                                                                        MD5:39CCF402A62F068A8C573B45EA96154D
                                                                                                                                                        SHA1:57CEB915EA6F88C7FCCA35339BF951659C0338AB
                                                                                                                                                        SHA-256:8649D77ACE8E5753B9A10E7AE3349AAFA9D8E3406BA9C8C36A59633A84B3C41B
                                                                                                                                                        SHA-512:C4F9225C54D413176CB3DD2B26D429493FD056C7C283BC7A1C52B4A2059DBB11380DAF5D847BE1FF29F058BA0EF44D4BF66A3D9E9A600000DC8F6D20DFB2ED03
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .....l................................................................`A.........................................l......h{..(.......x....P..l?..............<....d.......................c..(.......@...........p~...............................text....k.......l.................. ..`.rdata..lr.......t...p..............@..@.data....K....... ..................@....pdata..l?...P...@..................@..@.gxfg... &.......(...D..............@..@.retplne.............l...................tls....!............n..............@..._RDATA...............p..............@..@.rsrc...x............r..............@..@.reloc..<............x..............@..B........................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Programs\Slax\libGLESv2.dll

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):8418304
                                                                                                                                                        Entropy (8bit):6.508090684401189
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:98304:Q7XpFwEPVsR+1HYJnahAB4tVsX43wYMg:QXVrAtsw
                                                                                                                                                        MD5:F055A130C79BD517BDB53B1F8A38BD3B
                                                                                                                                                        SHA1:9FBA0AD4BA973BB285B23CC125004BAF61A98B5A
                                                                                                                                                        SHA-256:45B53759392B81CE7D916B3F1CF02BE30289809BD31D09FC1524EF2609183B17
                                                                                                                                                        SHA-512:D9DCB217F268862C577CACF4E9F84C63E02B647113D484338A74EB0B24FADD6D87B4E7A551DD1EF692BB38E44562BFF848982ACB62840D4F49F91A7751320E34
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......d...........N......................................`............`A........................................m.w.......x.d....p........}..H....................w.......................w.(.....d.@.............x.......w.@....................text.....d.......d................. ..`.rdata..D.....d.......d.............@..@.data.........y.......y.............@....pdata...H....}..J....}.............@..@.gxfg....-...........d..............@..@.retplne.....@...........................tls....B....P......................@..._RDATA.......`......................@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Programs\Slax\resources.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):5755390
                                                                                                                                                        Entropy (8bit):7.996220000544904
                                                                                                                                                        Encrypted:true
                                                                                                                                                        SSDEEP:98304:JZ5ti6+nkrht455GGPeenn0mJSwLEpxIvMi8rwrGU3nAaqdkmYAzFKwR4:j7ilnkrP455GGHnhEXU8kr1Xqdf1FvG
                                                                                                                                                        MD5:6772B597BF68622D934F207570E771B1
                                                                                                                                                        SHA1:F2A80FBFA034CB1FA07DC9AA37BF9F5B2280FF13
                                                                                                                                                        SHA-256:268DE4D99AB7C4F4EE32C8E8CB2B058A2C8D0D839F468AE8E8C0605FEAA736EA
                                                                                                                                                        SHA-512:A2BE67DF09951C9EF9200DCCCBDFF13736921522191F0001DA539D5C7F26B5B26A6B810BE6963908F216768C98D21E52486C7E00538CC0730E8C78E78811B85B
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:............f..#..{.V...|.*1..~..4....OG....aI................V...........@..............................................D9....Dc....D.....D.....D.....D.....D,....D" ...D*$...D.$..HE.$..IE.(..JEx*..SE-/..TE.8..UE.G..VE.h..\E.q..]E.r..^E.s..`E*t..aEty..bE....cExo..dE.Z..eE.[...E.\...E.m...Eho...Exs...E.u...E.{...E.....E....E.....E.....E[....E....EV....E.....E.....E7....E.....E.....E2....E.....L9....L.....L.....L+....LP....L.....L(.../Lo...0L5...1L,)..2L.3...Q.D...Q.P...QdY...Q.\...Q._...Q.j...Q.k...Q.l...QAn...Q.....Q.....R.....R....ZdA&..[d"(..\d:=..]d.@..^dpA.._d3D..`d.G..adqI...d.T...d.Y...d._...d.m...d.p...dUu...d.v...d.x...d.y...d.|...d;....d....6eL...7e|...8e...9e5...:e....;e....<e....=e....>e#...?e....@eo...Ae....Be=...Cex....gp....ga0...g.2.....3.....6.....*....X+.....2.....2.....4.....9.....L....K...........a.....g.....9.....Y.................7... .>...<..L..=..M..>..S..?..X..@.cZ..B.]g..C..i..D..s..E..v..F..w..G.i...H.....I.....J.....K.]...L.....M.....N.S...O._...P.L...Q...

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ij3d3u3.tdd.ps1

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):60
                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kg4hh30c.qyv.ps1

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):60
                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lmmot24b.tbn.psm1

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):60
                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qcpxxt0t.mqs.psm1

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):60
                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\LICENSE.electron.txt

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1096
                                                                                                                                                        Entropy (8bit):5.13006727705212
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                        MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                        SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                        SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                        SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\LICENSES.chromium.html

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:HTML document, ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):9099045
                                                                                                                                                        Entropy (8bit):4.754770173605162
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24576:2o9dQ06p6j6j1WOwRiXjYmfy6k6mjK64jK6gjK6e6cjK6feGjl8PpE:BFOeGT
                                                                                                                                                        MD5:6FF57C0AECCDF44C39C95DEE9ECEA805
                                                                                                                                                        SHA1:C76669A1354067A1C3DDBC032E66C323286A8D43
                                                                                                                                                        SHA-256:0BA4C7B781E9F149195A23D3BE0F704945F858A581871A9FEDD353F12CE839CA
                                                                                                                                                        SHA-512:D6108E1D1D52AA3199FF051C7B951025DBF51C5CB18E8920304116DCEF567367ED682245900FDA3AD354C5D50AA5A3C4E6872570A839A3A55D3A9B7579BDFA24
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\Slax.exe

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):188703744
                                                                                                                                                        Entropy (8bit):6.7582799459614025
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:1572864:bwl41lgY+w9QLv1JWYc6UeOtUUGQUT1jdu4BPPuuwT2GOqiB1sr7zjg7ob753oUV:RF4oD0QdG09P
                                                                                                                                                        MD5:262797985453830673179336B6BACAC6
                                                                                                                                                        SHA1:E8AB15D4C8606CF1341F2CD7EF27F69145C0F372
                                                                                                                                                        SHA-256:663C85DDB2BDA40E449BFD73F2E13E8B5C007240266F1440DFC42ECE6E2D36CC
                                                                                                                                                        SHA-512:C95598F7DDC560AE9110201D354F61D8621EC8AF83E93E550DFE58B10C1DF0BE060ECDABAAB0CE4A2DCFC2B77152A044E3B824BEB4623958D388EC6A5C63D925
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."......FH.........`IY........@.............................p~...........`..........................................d..k...0...h....`m.H.....#...H..........0o..5..P.......................0...(....}H.@............................................text...*DH......FH................. ..`.rdata.......`H......LH.............@..@.data....H......L..................@....pdata....H...#...H.................@..@.gxfg....B...pl..D....-.............@..@.retplne......l......*...................rodata.......l......,.............. ..`.tls..........l......>..............@...CPADinfo8.....m......D..............@...LZMADEC.......m......F.............. ..`_RDATA.......0m......X..............@..@malloc_h.....@m......Z.............. ..`prot.........Pm......\..............@..@.rsrc...H....`m......^..............@..@.reloc...5...0o..6....0.............@..B................

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\chrome_100_percent.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):151599
                                                                                                                                                        Entropy (8bit):7.915992368779121
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
                                                                                                                                                        MD5:83EC43F2AF9FC52025F3F807B185D424
                                                                                                                                                        SHA1:EA432F7571D89DD43A76D260CB5853CADA253AA0
                                                                                                                                                        SHA-256:A659EE9EB38636F85F5336587C578FB29740D3EFFAFF9B92852C8A210E92978C
                                                                                                                                                        SHA-512:6DDCA85215BF6F7F9B17C5D52BD7395702515BC2354A8CD8FA6C1CCD7355A23B17828853CEABEEF597B5BCA11750DC7C9F6EC3C45A33C2106F816FEC74963D86
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:..........<.............h.....i.\...j.....k.I...l.....n.....o.....p.:...q.4...r.o...s.?...t..!..u..%..v.@'..w..1..x..<..y.l?..z..C..{..G..|..I..}..J..~..M.....O.....R....|V.....Z.....]....N`.....a....3c....gd.....e....@g.....g.....m....~s....Fw....&{.....~..........*.....m................8..........._...........1....V.............w....e........F.........'....Z....k....5...,.....-.h........./.....0.!...1.....6.f...7.....8..!....$....&...../.....1.....5....3:....CE.....F....(O.....U....b[.....`....g....^i.....m.....q....V{....v~..............R...............X.....#.................................................|.....S..........W...........i..........2.....`...........S...........S.....(............................s...........y.....N.....".......................&.............................................Q"....-#.....#....$....v%....?&.....&....*(.... ).....*...........2....33....3.....3.....4....5....v6.....6.....7....f7....7.....7.....>.....A....sB

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\chrome_200_percent.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):228644
                                                                                                                                                        Entropy (8bit):7.946488830213853
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
                                                                                                                                                        MD5:DC48A33BD20BFC7CACFC925A84B015B6
                                                                                                                                                        SHA1:8DFEE88FD1DC77F89AD88C19146FE3AB45E43F3C
                                                                                                                                                        SHA-256:2C1B3E4B8A0CF837AE0A390FCA54F45D7D22418E040F1DFEA979622383ACCED6
                                                                                                                                                        SHA-512:1D54EB5D2BA06AF0BA8F6B491B0D43F178A48AC82CDF383BEB265E732DDFC06BCA9692003FDFCE56F7F00AF97F29ACF046C73B891B8C561610098F9626EAF05A
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:..........<.........&...h.....i.....j.....k.....l.....n.....o.|%..p..*..q..-..r.85..s..:..t..>..u.CG..v..K..w.._..x._t..y.{y..z....{.4...|....}.m...~...............................................h.............................5.................t...........-.................D............$.....-....K9.....@....FH...bL...9O...nT...)U...jV...UZ....]...s`...xc...f....j...n..,.\r..-..s....ku../..v..0..w..1.Dx..6..x..7.....8.Q............................F................S..........{...........^.....@...........!....%....&/....R2....:....>....RH....R.....V....|X....Sa.....i....k.....n.....r.....y.....{....%..........`.....7...........................................0.....I..........;.....l.....b.....B.....%.....S.....m..........L...........R..........V...........g.....)........................!.....'....-....u3.....4.....5.....6.....8....:9.....:.....<....=....`?....$L.....\....v\.....\....;].....]....._....._....K`....`.....a....]a....a.....g.....k....Rl

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\d3dcompiler_47.dll

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):4916728
                                                                                                                                                        Entropy (8bit):6.398031738914566
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
                                                                                                                                                        MD5:A7B7470C347F84365FFE1B2072B4F95C
                                                                                                                                                        SHA1:57A96F6FB326BA65B7F7016242132B3F9464C7A3
                                                                                                                                                        SHA-256:AF7B99BE1B8770C0E4D18E43B04E81D11BDEB667FA6B07ADE7A88F4C5676BF9A
                                                                                                                                                        SHA-512:83391A219631F750499FD9642D59EC80FB377C378997B302D10762E83325551BB97C1086B181FFF0521B1CA933E518EAB71A44A3578A23691F215EBB1DCE463D
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K......JK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\ffmpeg.dll

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):2929152
                                                                                                                                                        Entropy (8bit):6.70454100720416
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:49152:ZBAnytEwrZu/3Q8rvnh2UGH6qfhtvRIdefZiC6Cry2:ZBFE6kfbrvnh21K+io
                                                                                                                                                        MD5:5A168CB3EA9D0E7400BAABF60F6AB933
                                                                                                                                                        SHA1:82A86CB7F42294AB4AD6669C19B92605D960B676
                                                                                                                                                        SHA-256:AF5F1BC9F6A73750FA0C7BF17439700CFB3AB23E1393F0C9899825417E319B54
                                                                                                                                                        SHA-512:7C1441ECD049543E38297A7B6929E9F3EB978422D0CE508FBE6350FFEBD297F947B8D9EC75BD2054142DCD8461EEF1BF110E040D0830DA977FDE8944BECE843D
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......#...................................................:...........`A..........................................*.......*.(.............9..............:.<5....*.......................*.(.....$.@...........H.*.8............................text.....#.......#................. ..`.rdata........$.......#.............@..@.data.........+.."....+.............@....pdata.......9.......+.............@..@.gxfg....+...0:..,...J,.............@..@.retplne.....`:......v,..................tls.........p:......x,.............@..._RDATA........:......z,.............@..@.reloc..<5....:..6...|,.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\icudtl.dat

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):10468208
                                                                                                                                                        Entropy (8bit):6.265606239082294
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
                                                                                                                                                        MD5:FFD67C1E24CB35DC109A24024B1BA7EC
                                                                                                                                                        SHA1:99F545BC396878C7A53E98A79017D9531AF7C1F5
                                                                                                                                                        SHA-256:9AE98C06CBB0EA43C5CD6B5725310C008C65E46072421A1118CB88E1DE9A8B92
                                                                                                                                                        SHA-512:E1A865E685D2D3BACD0916D4238A79462519D887FEB273A251120BB6AF2B4481D025F3B21CE9A1A95A49371A0AA3ECF072175BA756974E831DBFDE1F0FEAEB79
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E...(...E...)...F...).."F...1..5F..`1..EF...N..XF..PN..hF...N..xF.......F.......F.......F..@....F.......F......F..0....F.......G......$G......7G......JG......]G..@...pG.......G.......G..@....G.......G.......G..@....G.......G..p....H..`....H.......H..@...AH......TH..p...gH.....zH.......H..`....H.......H.......H..P....H.......H......H..`....I......%I..P...:I......RI.....bI..@...uI.......I.......I.......I..P....I.......I.......I..0....I.......J... ...J.. !..-J..@$..=J...$..PJ...$..qJ.......J...<...J....&..J....&..J.. .&..J....&..K..`.&..K....&.3K....&.JK..0.&.aK....'.xK....'..K....'..K...(..K....(..K...O)..K....)..L..0Q*.>L..`.*.gL..Pi+..L....+..L...i,..L....,..L..P}-..M..@.-.,M.. .-.EM....-.\M....-.uM....-..M...$...M..0%...M....0..M...j0..M..`.0..N..p.0.1N....0.AN....0.TN..@.0.iN....0..N..0.0..N....0..N....0..N....1..N....1..N..

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\libEGL.dll

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):493056
                                                                                                                                                        Entropy (8bit):6.3672588781107775
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:0PfRujpqWG9btH+M1wLPfj9iDcHetGsHUN0dxI2H6sNkD4Fvh2W:eAWt+MWLPfjkVGbN0dxI2H63D4Bh2
                                                                                                                                                        MD5:39CCF402A62F068A8C573B45EA96154D
                                                                                                                                                        SHA1:57CEB915EA6F88C7FCCA35339BF951659C0338AB
                                                                                                                                                        SHA-256:8649D77ACE8E5753B9A10E7AE3349AAFA9D8E3406BA9C8C36A59633A84B3C41B
                                                                                                                                                        SHA-512:C4F9225C54D413176CB3DD2B26D429493FD056C7C283BC7A1C52B4A2059DBB11380DAF5D847BE1FF29F058BA0EF44D4BF66A3D9E9A600000DC8F6D20DFB2ED03
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .....l................................................................`A.........................................l......h{..(.......x....P..l?..............<....d.......................c..(.......@...........p~...............................text....k.......l.................. ..`.rdata..lr.......t...p..............@..@.data....K....... ..................@....pdata..l?...P...@..................@..@.gxfg... &.......(...D..............@..@.retplne.............l...................tls....!............n..............@..._RDATA...............p..............@..@.rsrc...x............r..............@..@.reloc..<............x..............@..B........................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\libGLESv2.dll

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):8418304
                                                                                                                                                        Entropy (8bit):6.508090684401189
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:98304:Q7XpFwEPVsR+1HYJnahAB4tVsX43wYMg:QXVrAtsw
                                                                                                                                                        MD5:F055A130C79BD517BDB53B1F8A38BD3B
                                                                                                                                                        SHA1:9FBA0AD4BA973BB285B23CC125004BAF61A98B5A
                                                                                                                                                        SHA-256:45B53759392B81CE7D916B3F1CF02BE30289809BD31D09FC1524EF2609183B17
                                                                                                                                                        SHA-512:D9DCB217F268862C577CACF4E9F84C63E02B647113D484338A74EB0B24FADD6D87B4E7A551DD1EF692BB38E44562BFF848982ACB62840D4F49F91A7751320E34
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......d...........N......................................`............`A........................................m.w.......x.d....p........}..H....................w.......................w.(.....d.@.............x.......w.@....................text.....d.......d................. ..`.rdata..D.....d.......d.............@..@.data.........y.......y.............@....pdata...H....}..J....}.............@..@.gxfg....-...........d..............@..@.retplne.....@...........................tls....B....P......................@..._RDATA.......`......................@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\af.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):533447
                                                                                                                                                        Entropy (8bit):5.412080848029905
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:WEGL+ocurcdy6VGycsaja+H2Jyngae5Ig1eo0vMIlgL2pQ+FXZG2vt2pslFd5/51:W1+ozrc86VZBaja+H2Jyngae5Ig1eo0N
                                                                                                                                                        MD5:D9BEC09B6C523DC3BCA9A81264B1BEED
                                                                                                                                                        SHA1:EA4AE9DFF554C59994632F85AF25B36C049FB5B2
                                                                                                                                                        SHA-256:0B5A45DE223CE8522CC296AF1E93477540EAA74867428307CC3A5CD21921B022
                                                                                                                                                        SHA-512:6E7677F86F73EDFFB5D6162CA19BB7464465F0F485CE2971FB20AD3F57D9FAC56B7A21D378701F80E85FB185C3AF6A238F8C8707F5874BFFFFD79D881A54DD6E
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.....j.....k.)...l.4...n.<...o.A...p.N...q.T...r.`...s.....t.....v.....w.....y.....z.\...|.....}.........................................................................#.....2.....C.....V...........A.......................c.........................................M.......................F.......................!.....o.......................c.................$.....y.................0.......................,.......................7 ..... ..... ..... ....h!.....!....."....1"....."....."....."....."....E#.....#.....#.....#.....$....@$...._$....h$.....$.....%....L%....[%.....%.....&....B&....R&.....&.....&.....'.....'....n'.....'.....'.....'....7(.....(.....(.....(....1).....).....).....)....Q*.....*.....*.....*....1+....s+.....+.....+.....,....U,....z,.....,.....-....]-.....-.....-....*.....h.......................I/....u/...../...../....A0....|0.....0....#1.....1.....1.....2....}2.....2.....3....=3.....3.....4....54....H4.....4.....4.....4.....5....e5.....5.....5

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\am.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):861015
                                                                                                                                                        Entropy (8bit):4.906916579483596
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24576:HzD984ToH3hTCNRysrxQH9hjN3Rpzvh51muMXqVFq+XG/6WxLP5A:qn5N
                                                                                                                                                        MD5:E3933DE22DC7FB98215B083D8A379F40
                                                                                                                                                        SHA1:68DDBD9BCC931F0D4A172FA65AF35B823C7C9E37
                                                                                                                                                        SHA-256:EAA747075E5A62BE8B7DF5908E167CCC5314C9C6A8B890059D00284A3C496FEF
                                                                                                                                                        SHA-512:7BEB80FA029F41CB21536B15C604E2AE9DFC20B4A3EC4F5CC04E2B105D4B2C251830624957197084761F9686F95D332E25D4F6178509AD58257AF90D96A9E7D5
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.%...j.1...k.@...l.K...n.S...o.X...p.e...q.k...r.w...s.....t.....v.....w.....y.E...z.s...|.....}.................................................&.....'.....(.....-.....I....._.......................`...................................6.................S...........E...........P.................x.................S ..... .....!.....!.....!....P".....".....".....#....^$.....$.....$.....%.....&....c&.....&.....'.....'.....(....A(.....(....{).....).....).....*.....+.....,....H,.....,.....-....C-....v-.....-....N................../....w/...../...../....u0.....1....y1.....1....@2.....2....03....F3.....3....c4.....4.....4...._5.....5....16....P6.....6....T7.....7.....7....`8.....9.....9.....9....0:.....:.....:.....;.....;.....;....6<....^<.....<....c=.....=.....=....{>.....>....b?.....?....*@.....@.....@.....@.....A.....B....RB....qB....,C.....C.....D....7D.....E.....E....TF....nF....9G.....G....NH.....H....LI.....I....`J.....J.....J....FK....lK.....K....8L.....L....6M

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\ar.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):943328
                                                                                                                                                        Entropy (8bit):4.930661249056055
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:NYI8HRnwBUC/+/RYfESugvPUB6m7kOCSn5KNp5QpnSKU/:SNHRnh5aQM
                                                                                                                                                        MD5:AC865FF462F341B4317C3D16EEB40460
                                                                                                                                                        SHA1:1E971D97F09884B23595F17534227EA43CF99090
                                                                                                                                                        SHA-256:0557BC17EB1D134BD52F203836551B55579114708E2DF51F653972951567513D
                                                                                                                                                        SHA-512:A935B91A2C053303E941866CFC151F28053FAF364AEECE98D61FCD68FEF6C6F1D3B73DE01CD602C8A4A081CCE452D1CE87F8166BA3C0E8B81E91D932F84737F2
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:........j(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.&...t.=...v.r...w.....y.....z.....|.....}.K.....t.....y.......................................................................L.....@.....#....................... .....|...........H...........m...........?...........L.....}.............................k............ ....) ..... ....a!.....!.....!....."....\#.....#.....#.....$.....%.... &....Q&.....&.....'.....'.....(.....(....l).....).....).....+.....+.....,.....,....p-.....-..........Y...........B/....u/...../.....0.....0.....0.....0.....1....Z2.....2.....2....h3.....3....,4....=4.....4....w5.....5.....5....q6.....6....57....L7.....7....W8.....8.....8....F9.....9....H:....e:.....:....d;.....;.....;....K<.....<.....<.....=....L>.....>.....>....U?.....?.....@....a@.....@....9A....\A....yA.....B.....B.....B.....C.....C.....C....KD....dD....lE....MF.....G.....G.....G....mH.....H.....H.....I.....J....EJ....\J.....J....%K....KK...._K.....L.....L....&M....HM.....M

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\bg.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):982837
                                                                                                                                                        Entropy (8bit):4.669923863173967
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24576:MhQgWoOYLYyzQkECvUPVbKDks373ZAW3AAK1mVDLpv74umpjd2SI5IxuFsoGQXxQ:VgWoOYLYfYUPVbKDks373ZN3ApmVDLpw
                                                                                                                                                        MD5:7C37C8C9B4215089B6C16D22838D256B
                                                                                                                                                        SHA1:8F2AFDC21353685353A0562452F4A79180E58829
                                                                                                                                                        SHA-256:2EBD582DFAA3139CD6A03E9892A94A3D9BB6936E0B04085B8F2D27E1DEC0BC8A
                                                                                                                                                        SHA-512:BEADD70E9D706576BFB6725617385F776E9F68C84D116B01187354D377E2C860899DA34F8C5A054C4BDE41A57E9AAC56445F6AC0B8DA8C75A424641A86FDD718
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i."...j.....k.=...l.H...n.P...o.U...p.b...q.h...r.t...s.....t.....v.....w.....y.B...z.p...|.....}.................................................#.....$.....%.....*.....L.....e.............................$.....U.................9.....c...........p...........Z.....P.......................r ..... ....F!....l!.....".....".....".....#.....#.....$.....%....b%....^&.... '.....'.....'.....(.....)...."*....X*.... +.....+....5,...._,....K-......................./.....0....N1.....1....C2.....2.....3....)3.....3....\4.....4.....4....z5.....6....J6....p6....'7.....7.....8....E8.....8....n9.....9.....9....l:.....:....0;....P;.....;....a<.....<.....<....n=.....=....J>....r>....m?....S@.....@....-A.....A....^B.....B.....B...._C.....C.....D....gD....CE.....E....^F.....F.....G....3H.....H.....I.....I....NJ.....J.....J.....K....(L.....L.....L.....M....8N.....N.....N.....O.....P....XQ.....Q....}R....7S.....S.....S.....T....dU.....U.....U.....V.... W....kW.....W.....X....dY.....Y

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\bn.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1267393
                                                                                                                                                        Entropy (8bit):4.284356072775859
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3072:LEcoGqGB2le1abaCb6Ew/0WySZIS+xd2f/MHDrYfHBpxspSPrCXqB+iBbHRI8T51:LjJfa56/0z5XpCOXqB+iBbD5YqNn
                                                                                                                                                        MD5:FC66ADF3DEAC72FD39105540DD2DAEFF
                                                                                                                                                        SHA1:A53B54EFCC1285A226D605116F87D12F69942482
                                                                                                                                                        SHA-256:EF50CFEBAF9E32EDEEC25D30197AC5899B3DB8A0676671F639D32BC48F3B3BD8
                                                                                                                                                        SHA-512:0B77DAA056451D01A8CFB3FF1ACC08D34E64E0A32BB119C8837AE3D6E3D5195311427C6101EFD7E7BC9104AA369832BB12AAB3D4080C00DC39EDC98B6C0B949E
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.....j.....k.....l.#...n.+...o.1...p.>...q.D...r.P...s.....t.....v.....w.....y.....z.L...|.s...}...............................................................................0.....U.....................................................?.......................Z.................. ..... ....(!.....!.....".....#....N#.....$.....$.....%....+%....R&....0'.....'.....(.....).....)....^*.....*.....+....~,.....-....1-.....-.........../....E/....@0....*1.....1.....1.....3.....4.....4.....5.....5....k6.....6.....6.....7.....8....`8.....8.....9.....9.....9.....:.....:.....;.....;....:<.....<.....=.....=.... >.....>....{?.....?.....?.....@....9A.....A.....A....XB.....B....LC....rC.....D.....E....{F.....F.....G.....H.....I....QI.....I....sJ.....J.....J.....K....iL.....L.....M.....M.....N....^O.....O.....P....#Q....oQ.....Q.....R....5S.....S.....S.....T....{U....#V....\V.....W.....X.....Y.....Z....@[....B\.....\....L].....^.....^....W_....._....]`....$a.....a.....a.....b.....c

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\ca.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):598934
                                                                                                                                                        Entropy (8bit):5.408962543645936
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:gVHfWsqPdf9nwWF47D1MeCi24b3Fe5PFFuN3Mw2juwHzejm0t3l3kb7TenzL8wOs:gV/WRdlnPyToiL6YhgMNxgCh5cxSas
                                                                                                                                                        MD5:E1AC7F4C28177F68FAC3BE2375A9368C
                                                                                                                                                        SHA1:3D7738699087468A748F9B1189D2F7621187D03B
                                                                                                                                                        SHA-256:EFA1BA906F8ABCE91EBB9D6442B64E0D5AE7DAB78DDA8A49A6FED1A342C71B9B
                                                                                                                                                        SHA-512:AEE8CB28EB02E2FB2155C8D093CF678284E3571F46B913F743DE3C6D0215C18B80866FF446F46ADA160860ED9C18AE9A4209424E7E0F0BA97C78A3FE9815CA5A
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.....j.....k.!...l.,...n.4...o.9...p.F...q.L...r.X...s.....t.....v.....w.....y.&...z.T...|.{...}.........................................................................%.....>.....^.....|.......................7.................S.....l.............................m.......................v.......................k...................................2.....`...........R.................- ..... ..... ..... ....I!.....!.....!.....!....c".....".....#....,#.....#....L$.....$.....$....3%.....%.....%.....%.....&....i&.....&.....&.....&....N'....{'.....'.....'....\(.....(.....(.....)....b).....).....).....)....H*....s*.....*.....*.....+....I+....V+.....+.....,....A,....R,.....,....D-.....-.....-..........\................../....L/....o/...../.....0....S0....h0.....0....N1.....1.....1....+2....r2.....2.....2.....3....^3.....3.....3.....4....c4.....4.....4....b5.....5....\6....w6.....6....c7.....7.....7....I8.....8.....8.....8....@9.....9.....9.....9....9:.....:.....:.....:

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\cs.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):616994
                                                                                                                                                        Entropy (8bit):5.843791316218894
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:863oqX0hmR4QkWA9jN85ASh6mARAO52C+wH/NOKbJSBXR8QQ:VYPNB85AS0P52C+wH/NOeJS+
                                                                                                                                                        MD5:92E3FD1EB47767A0CB5F6E734DE4EEC1
                                                                                                                                                        SHA1:33053BFEAD1FA67160B6A3C417EC4559BFDCDCFB
                                                                                                                                                        SHA-256:D269E16FBD9B2AFE95B148ECE22B2AC803768FB53EE42E1FAD0181F9DEC84544
                                                                                                                                                        SHA-512:916D73D9B28B0600878418A06388C2ED61BFAF17807A16E1C157A30E5DA136C6B6F194E99D151C43B9AA35D101DE755CAA6DA69E1C8A50DD134F27A7F2ADC016
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.....j.....k.....l.....n.....o.....p.&...q.,...r.8...s.g...t.~...v.....w.....y.....z.4...|.[...}...........................................................................................4...........^.................<.......................i...........A.....Z...........?.....{.................U.......................D.....l.................T.................:.................+............ ....K ....c ..... ....6!....k!....{!.....!....k"....."....."....:#.....#.....#.....$....u$.....$.....$.....$....N%.....%.....%.....%..../&.....&.....&.....&.....'.....'.....'.....'....2(.....(.....(.....(....-).....).....).....)...."*.....*.....*.....*....:+.....+.....+.....+....f,.....,....)-....@-.....-.....-.....-..........Q.......................W/...../...../...../....]0.....0.....1....I1.....1.....1.....2.....2.....2.....3....13....F3.....3.... 4....a4....y4.....4....g5.....5.....5....E6.....6.....7....77.....7.....8....D8....Y8.....8.....9....49....H9.....9....":....\:

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\da.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):558889
                                                                                                                                                        Entropy (8bit):5.449151445338137
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:Gqv1aOSLABh3359zVmh5OsfZh1seDrwwlQJWJwgIobwmPaHL95bpkUdRi3jd4xFm:GqonsMfPrWb55bpfddm
                                                                                                                                                        MD5:43029018648D558F9BBF7A74C59EB281
                                                                                                                                                        SHA1:90C6618CCCB4DB85D7485AE8D809EC3AF4763E70
                                                                                                                                                        SHA-256:4BD88F6AB82842358987AAD384775B35198DD75C2CCE4CAE783208ED69296A7E
                                                                                                                                                        SHA-512:9E8EF9D4367AD01F2F4E7DD6F9884E463729EE5A0F678FD16A3CE093C21EFC1D78041D5C6E45037F37BFD732E4833744485B00ACFDA2313A1D1E947993129A3D
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.+...j.7...k.F...l.Q...n.Y...o.^...p.k...q.q...r.}...s.....t.....v.....w.$...y.K...z.y...|.....}...........................................%.....,.....-...........0.....>.....N.....b.....{...........`.................!.......................l...........A.....]...........-.....].....q........... .....G.....T.................2.....@.................8.....R...........>.....z.................w.................. ..... ..... ..... ....l!.....!....@"....Z"....."....s#.....#.....#....A$.....$.....$.....$....(%.....%.....%.....%.....&....Z&....~&.....&.....&....R'.....'.....'.....'....W(.....(.....(.....(....K)....v).....).....)....**....P*....Z*.....*.....+....@+....N+.....+....I,.....,.....,.....-...._-.....-.....-.....-....<.....Z.....r............/....6/....F/...../.....0....h0.....0.....0....W1....|1.....1.....1....b2.....2.....2.....3....T3.....3.....3.....4.....4.....4.....4....q5.....5.....6....N6.....6.....7....J7....\7.....7.....7.....8.....8.....8.....8.....9

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\de.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):596603
                                                                                                                                                        Entropy (8bit):5.5059525736264
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:55U5D5aDs3K7UpGg5aL9Xtt5fPMkUz1CTz:5eaDs3K7UpGg5aLRf53MtCTz
                                                                                                                                                        MD5:3A8DE004B3A610271E1D1913B6D4B53B
                                                                                                                                                        SHA1:236893C3F7B450E6AD8B4D54E1A62B2E635B42D6
                                                                                                                                                        SHA-256:43C060182C92CAF4AEBF8FD7B913DFE017BEEA71E796E862EBF8746575948364
                                                                                                                                                        SHA-512:B70F849CCF7DD9E72D71522591420E0BAA03FF74763B44563B0B3800BA3A88CB8B973FABB90BBB6653819947ECA47F70E347958E3C31AB226957F7313BC03554
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:........((C.e.....h.....i.'...j.3...k.B...l.M...n.U...o.Z...p.g...q.m...r.y...s.....t.....v.....w. ...y.G...z.u...|.....}...........................................!.....(.....).....*.....,.....=.....P.....b.....x.....2...........J....._...........b.................?...................................?.....W...........B.....p.................k.................:.............................'.....c............ ..... ..... ..... ....O!.....!....."....#"....."....O#.....#.....#....]$.....$....Q%....p%.....%....O&....q&.....&.....&....^'.....'.....'.....(....p(.....(.....(....1).....).....).....*.....*.....+....7+....G+.....+.....,....a,....r,.....,....W-.....-.....-............................j/.....0....W0....m0.....0....J1....l1.....1.....1....62....S2....f2.....2....93....b3....u3.....4.....4.....4.....4...._5.....5.....5.....5....q6.....6.....7.... 7.....7.....8....X8....n8.....8....|9.....9.....9....i:.....:....);....V;.....;....?<....l<.....<.....<....U=....~=.....=.....>.....>.....>

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\el.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1076241
                                                                                                                                                        Entropy (8bit):4.759988949622547
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24576:yvHcaFbu4FDYX9QCMDhWJXDsS7miHk3D2NpYRDojvmXgVT8y2IWYNQKlCt2rDQur:aHcaFbu4FDYX9QCMDhWJXDsS7miHcD2r
                                                                                                                                                        MD5:58D6EAF71B9B73F5F7F057C73D0D92EC
                                                                                                                                                        SHA1:16E0587753E7D2834F4CBB24FED45E7BD2F8F2F4
                                                                                                                                                        SHA-256:8474879DE21C414D34C44CF0A8C91356A66DBD647308A4F994BE25BD1F93A89F
                                                                                                                                                        SHA-512:AB24C9655BD68E4A64E257914A35DC84B5F791C58B396AE004BF5DA61DF19C02EF9CA572B8E63F15BAF3694AE1E540ADF74586F10D28D7EF90EDEEC982BCF28D
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.....j.....k.....l.(...n.0...o.5...p.B...q.H...r.T...s.....t.....v.....w.....y."...z.P...|.w...}...............................................................................S...........................................................T.....\.....0.................1...........F ..... ....C!.....!....)"....J"....."....~#.....#.....#.....$.....%.....%.....&.....'.....(.....(.....(.....)....t*.....*.....+.....+.....,....'-....R-....C............/...../.....0.....1.....2.....2....~3..../4....{4.....4....R5.....6....H6....m6.....7.....7.....8....<8.....9.....9....]:.....:....Q;.....<.....<.....<....y=....O>.....>.....>.....?....Y@.....@.....@.....A....QB.....B.....B.....C.....D....wE.....E....|F....DG.....G.....G....}H.....I....<I....XI.....J.....J.....K....0K.....L.....L....YM.....M....VN.....O....<O....cO.....P.....P....NQ.....Q....kR.....S.....S.....S.....T.....V.....V.....W.....X.....X....dY.....Y.....Z.....[....7\....h\....#].....]....W^....y^....._....z`.....`

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\en-GB.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):485863
                                                                                                                                                        Entropy (8bit):5.521699894815275
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:Ll+Npdwk8sj7ahcbKdFk+ufMP9ezQSKrfaYdrcLlY5IPxZBcvRJ+G:Ll++143fMuQSK3Z5MxLG
                                                                                                                                                        MD5:985558DE03BF486AEC1DAADD39CB508D
                                                                                                                                                        SHA1:B693DDEF983E8AF212936202DDCA92D908378404
                                                                                                                                                        SHA-256:1956D448A4D333638F3601D0DA976710CBE0A795504EB694BA18311FE586D195
                                                                                                                                                        SHA-512:13D1C82B797AD4FF25A94A996F9FB52B530643A0E735F96E32B9E0698962770148D95DB7BEB91343D781FB84378A3E334AC0C1C913D8DBAE20F425BF0DC364D3
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........)d.e.....h.....i.....j.....k.....l.....n.....o.....p."...q.(...r.4...s.c...t.z...v.....w.....y.....z.0...|.W...}...........................................................................................'.................E.....Y.......................>.................:.....P.................$.....9.............................K.............................Y.....~.................L.......................:.....k.....y.................;.....K.................. ..... ..... ..... ....!!....5!....t!.....!.....!.....!....."....N"....m"....w".....".....".....#....##....}#.....#.....#.....$....^$.....$.....$.....$....)%....n%.....%.....%.....%.....&....V&....a&.....&.....&.....'....#'.....'.....'.....(.....(....|(.....(.....(.....(....>)....z).....).....).....)....>*...._*....n*.....*.....+....G+....m+.....+.....+.....,.....,....q,.....,.....,.....,....`-.....-.....-.....-....[............/...../...../...../.....0....-0.....0.....0.....0.....1....Q1.....1.....1.....1.... 2....m2.....2

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\en-US.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):490357
                                                                                                                                                        Entropy (8bit):5.513411409378336
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:1kdXRDCwszpReMP9e0QcD2faYjNCu454ZxDng/t/XFLwB:1sUwGeM1QcDq+5UxOLwB
                                                                                                                                                        MD5:752A3FEED3AB6C127767C8FABC9A40B6
                                                                                                                                                        SHA1:4AF9F9C19904D3BEF154B469858DC44B1E630A75
                                                                                                                                                        SHA-256:C6A6C5D7AB6119BBA712D6FE45FD385506D4D0DD8E4156CCA3925062F4502AC5
                                                                                                                                                        SHA-512:AE96D4F391E36F8F741671B72EBD4B1AB2D049B2A99B95737FB9F81743B9E414B46022B65194AF5616EB354056ADDF0E46EF090F56B7D945EF2CB5F4D100D64F
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:........O)..e.\...h.d...i.l...j.x...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.9...w.e...y.....z.....|.....}.......;.....@.....H.....P.....X....._.....f.....m.....n.....o.....t.............................#.......................;.......................0.......................3.....~.......................S.....|.......................=.....J.............................z.......................l.......................H........................ ....^ ..... ..... .....!....^!.....!.....!.....!....*"....E"....T"....."....."....."....."....8#....u#.....#.....#.....#....J$....|$.....$.....$....&%....S%...._%.....%.....%.....&....!&....i&.....&.....&.....&....)'....n'.....'.....'.....(....](.....(.....(.....(....=)....`)....v).....).....).....*....1*.....*.....*.....*.....*....P+.....+.....+.....+....7,....n,.....,.....,.....,....7-....a-....q-.....-..........N.....f...........7/...../...../...../....J0.....0.....0.....0....@1....l1....{1.....1.....2...."2....22.....2.....2.....3

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\es-419.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):589663
                                                                                                                                                        Entropy (8bit):5.378608358697393
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:cv+c/pQ8eguGEy1mVpDYl7G8oZOZ5zazaQ+ax891:cP3RsJpuGS5za9+D1
                                                                                                                                                        MD5:85E9B056E3AC3F6A5B113ED9F460E202
                                                                                                                                                        SHA1:DCCEEF6EA85D71A85DD24D17EC65371DCE76F480
                                                                                                                                                        SHA-256:16FE83762ED578C49685868418325920A72CD457907BC4E5264F2C172D53B27B
                                                                                                                                                        SHA-512:E4DFDE9C1260DF1F77B7EC1797658F8CFEAAB98142A8D512ED3BFAC054933A4583F20091B97985B4BA9CF93F9FACA3E7B0986CB4A3EB12FE0BC04EE1C45D3E0F
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.....j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.?...z.m...|.....}................................................. .....!.....".....$.....6.....E.....Z.....q.......................$.................A.....Y...........i.................`.................2.............................r...................................H.....x...........n.................P ..... .....!.....!.....!.....!....'"....>"....."....*#....r#.....#....%$.....$.....$....$%....v%.....%.....%.....&....[&.....&.....&.....&....R'.....'.....'.....'....l(.....(.....)....0).....).....)....2*....>*.....*.....*.....+....&+....x+.....+.....+.....,....p,.....,.....-....'-.....-..........f.................A/....p/...../...../....C0....j0.....0....41....j1....z1.....2....o2.....2.....2...._3.....3.....3.....3....U4.....4.....4.....4....y5.....5.....6.....6.....6....C7.....7.....7....N8.....8.....9....;9.....9....!:....e:....y:.....:.....;....5;....H;.....;....9<.....<.....<

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\es.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):589284
                                                                                                                                                        Entropy (8bit):5.3587509940363995
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:Uxb0Q3M9BnWhau1WK4G0gkjqpT+ZbBQihXFijs5J+f2D//z/h6PZOkx:SAwx4Lep4BQiXijs5k2r/Lzk
                                                                                                                                                        MD5:3DB06EA954C83343BD333C15947F521A
                                                                                                                                                        SHA1:DDDE6AB9F9085E83EC8BF7A37DF3389040ACEA42
                                                                                                                                                        SHA-256:45DF7340FE3C8560B11FFBA2219DE1B5C45DBFE57B6DB90BD6C246244FAE338A
                                                                                                                                                        SHA-512:CC29F1075C119DADDAA108C17ABB6D572925CAC1ED2237ED2FD45364BFB2A00C1144FCCDD22C6728C954AF2CDD1B9477F39968BA25354BCA2B9DCA07F5C53DDE
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h."...i.*...j.6...k.E...l.P...n.X...o.]...p.j...q.p...r.|...s.....t.....v.....w.#...y.J...z.x...|.....}...........................................$.....+.....,.....-...../.....B.....R.....g.............................2.................Z.....p.............................}...........).....D.......................>.................(.....9...........3.....x...........'.......................k ..... .....!....*!.....!.....!....6"....K"....."....?#.....#.....#....7$.....$.....$.... %.....%.....%.....&.....&....t&.....&.....&.....'....f'.....'.....'.....(.....(.....(.....)....")....{).....).....*.....*....k*.....*.....*.....+....R+.....+.....+.....+....I,.....,.....,.....,....X-.....-............................./....-/...../...../.....0....$0.....0.....1....01....C1.....1....82.....2.....2.....3....i3.....3.....3.....4....g4.....4.....4....'5....w5.....5.....5....m6.....6....Q7....h7.....7....u8.....8.....8....g9.....9.....:....%:....w:.....:.....:.....;....l;.....;.....<

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\et.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):536344
                                                                                                                                                        Entropy (8bit):5.456021867812121
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:HeaF27VNhXV9R5OJs99Z0+I+eL40dmFZxEYTHbtiPSia6OSt75H50MHsjiCKM2a6:HhFEVN53Q6Z8+wmFZq0SfH50MIW
                                                                                                                                                        MD5:8E2C2CC8C516D8B7181C0C712CA24513
                                                                                                                                                        SHA1:E0CCD9ED8DE6640379F822A067DCF97D4BBE44A7
                                                                                                                                                        SHA-256:C96937F46FB1B1182B201F5C48FE1DA4D3F94A68A0E6E0699CCC0944CD0A5A33
                                                                                                                                                        SHA-512:339BC655F22068F2EE9352A670325865265E4279197430214F7E3FBA575415318110CCCB03AED2C0E7AC673D4629BD495DC34A56CEFBCAAB62E1C4A1A87ED8C2
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.2...h.:...i.K...j.W...k.f...l.q...n.y...o.~...p.....q.....r.....s.....t.....v.....w.D...y.k...z.....|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P.....`.....r...................................$.................#.....6.................U.....k...........4.....d.....v...........,.....Y.....d.................F.....Y.................C.....a...........?.....z.................^.......................f ..... ..... .....!....r!.....!.....!....7".....".....".....#....p#.....#.....#.....$....^$.....$.....$.....$....>%.....%.....%.....%....6&.....&.....&.....&....B'.....'.....'.....'....L(.....(.....(.....(....C).....).....).....)....C*.....*.....*.....*....\+.....+.....,....&,....y,.....,.....,.....-....j-.....-.....-..........d................../....f/...../...../....(0....t0.....0.....0.....0....Y1.....1.....1.....1....g2.....2.....2.....3.....3.....4....f4....z4.....5.....5.....5.....5....Z6.....6.....6.....7....\7.....7.....7.....7....>8.....8.....8

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\fa.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):876080
                                                                                                                                                        Entropy (8bit):5.051372514206481
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24576:nrL8u313uyqoT+seqyRmX5loTUOmdAQifaQ2XxFMJGk62YhYaiiIQMX4qOwUCMdq:ng56I
                                                                                                                                                        MD5:CAEE902136579F4BAC72A6F0F75D171B
                                                                                                                                                        SHA1:CBBAF988A499005E21FD86652E1F48AF8BCE2C35
                                                                                                                                                        SHA-256:E86F677E9654F6A16A7738E85A5A5D467A09CB18E47654F079506A00AFFAD70C
                                                                                                                                                        SHA-512:C0F2E8457F71789DA8CE207AAAE2F83196DAAC868FCAA7A84DE04DD38730F8831B9643B8A404A7AA59C5B726DA02090BBA414529019F5EB9C94AC5A5AF61BC9D
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:........R(..e.b...h.j...i.u...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.B...w.n...y.....z.....|.....}.......D.....I.....Q.....Y.....a.....h.....o.....v.....x.....}...............................................>....................... .................'.....P.................%.....L...................................$ ....n ..... ....4!.....!....."....=".....".....#.....#.....$.....$....G%.....%.....%....I&.....&....7'....U'.....(.....(....4)....V)....'*.....*....u+.....+.....,.....,.....,.....,....w-..........;.....L...........l/...../...../....\0.....0....L1....a1.....1.....2.....2.....2....i3.....3..../4....B4.....4....^5.....5.....5....K6.....6....-7....>7.....7.....8.....8.....9.....9.....:....I:....l:.....;.....;.....;....1<.....<....Z=.....=.....=.....>....(?....z?.....?....?@.....@.....@.....@.....A....WB.....B.....B....qC.....D....OD....pD....nE....fF.....G....-G.....G.....H.....H....$I.....I.....J.....J.....J....~K.....K....&L....GL.....L.....M.....M.....N

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\fi.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):547257
                                                                                                                                                        Entropy (8bit):5.425790227406111
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:sXTpn19l5MtWuah5EinUtWnSp0WahHNYM:yTlB5E8nRl
                                                                                                                                                        MD5:125A121C22DFC2B1A1C759CAD9123E42
                                                                                                                                                        SHA1:D0282AF9EC311C406ECCCDFDD7216B7D883E94C3
                                                                                                                                                        SHA-256:B733460F039DCB3795077BA91DAFA3B9B8163DFD0F15168B250630F7DE21ED0A
                                                                                                                                                        SHA-512:C6E0EA8FAB8115A632D4C74141EFC46EA546F43E0B806D5BD95A1ECD3B8FE37A44565A2F79C43E0BC50DBDADC5D16054E07485FAD83C99BD3550A907C852E724
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:........F(%.e.J...h.R...i.c...j.o...k.~...l.....n.....o.....p.....q.....r.....s.....t.....v.0...w.\...y.....z.....|.....}.......2.....7.....?.....G.....O.....V.....].....d.....e.....f.....k.....}.......................@.................$.......................0.................G.....]...........1.....d.....y...........&.....S.....a.......................'.........................................8.....R.................0.....F.................5.....J............ ....8 ....V ..... ....@!.....!.....!.....!....K"....n".....".....".....#....A#....O#.....#.....#.....$....'$....w$.....$.....$.....$....V%.....%.....%.....%....;&.....&.....&.....&.....'....n'.....'.....'.....'....M(....v(.....(.....(....`).....).....).....*....R*....n*.....*.....*....2+....T+....m+.....+....0,....T,....c,.....,..../-....f-.....-.....-........../.....>................../....1/...../...../....&0....@0.....0....C1.....1.....1.....2....q2.....2.....2....$3....|3.....3.....3.....3....A4....Z4....j4.....4.....5....I5

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\fil.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):618874
                                                                                                                                                        Entropy (8bit):5.2024833562888055
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:fGsQ2sSp+ynDQmiSANIhxp3amx5GhV7MQoE8AYzwK:fiolx5G7s
                                                                                                                                                        MD5:EAF43729E9BBD8004EF1FF56A3D85A48
                                                                                                                                                        SHA1:34B31AB8EA2CE6BD263F00ACC50D5AF8D0222D9A
                                                                                                                                                        SHA-256:8559CC35335BB2C249297F4C7506DF95CEF899EF5F7AD942D2D511AE074D41B0
                                                                                                                                                        SHA-512:010F8E5C3B969BE0DB4BAEC3ACFFDD69BE25662387968E15E11AF0DA68EC2F45DC9EDB83CAFE7C92234E1E4E4AAE1682223235AF04D99E8B5238379E022E3D35
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:........*)A.e.....h.....i.0...j.<...k.K...l.V...n.^...o.c...p.p...q.v...r.....s.....t.....v.....w.)...y.P...z.~...|.....}.....................................#.....*.....1.....2.....3.....8.....E.....Z.....p.........../........... .....:...........1.....v...........3........... .....G...........<.......................`.......................s.................J.................* ..... ....@!.....!.....!..../".....".....".....#....~#.....#....*$....D$.....$....?%.....%.....%....8&.....&....$'....F'.....'.....(....0(....M(.....(.....(....#)....0).....).....).....*.....*.....*.....*....5+....K+.....+.....,....M,....\,.....,.....-....Q-...._-.....-.... .....Q....._..........."/....T/....b/...../....c0.....0.....0....41.....1.....1.....1.....2.....2.....2.....2.....3....}3.....3.....3....G4.....4.....5....75.....5.....5....(6....B6.....6.... 7....S7....n7.....7....b8.....8.....8....k9.....:....n:.....:.....;.....;.....;.....<.....<.....<....,=....D=.....=.....=....$>....:>.....>....0?....l?

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\fr.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):637414
                                                                                                                                                        Entropy (8bit):5.391270599351283
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:ZPM7ZL85Z4p5ZR6QuaMVq0YzRnP4ZoZCMYnYyGGGDYQzc7IvO8Ixat40wCSsmlFI:ZPiYVW45F2
                                                                                                                                                        MD5:651E4CB14C4F784D36D0A1715C52DCF3
                                                                                                                                                        SHA1:540F6090E3223AD8E6424A9DB78305F2DB9974BF
                                                                                                                                                        SHA-256:6D547CBC3304627D14AEB138AEBD40786C30A4192E071D80BCECDB77A13AC80A
                                                                                                                                                        SHA-512:1FE93058EC434C06EF4AA1519333EBD831311971B06D7279DDC4D86DFA860BBD6EA6D127B2A07425C3E78BD6D41C11EB2A76CF25B20C6A7DE74D1F0CEEC87079
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.....j.....k.....l.....n.....o."...p./...q.5...r.A...s.p...t.....v.....w.....y.....z.=...|.d...}.....................................................................................$.....3...........{.................u...........*.....B...........`.................H.................+.........................................*.....?...........4.....w...........&.......................b ..... .....!....&!.....!.....!....;"....N"....."....9#....{#.....#....($.....$.....%....4%.....%.....%....*&....A&.....&.....&.....'..../'.....'.....'..../(....A(.....(.....)....G)...._).....)....(*....\*....q*.....*....#+....O+....]+.....+.....,....<,....K,.....,.....-....A-....U-.....-....X.................7/...../...../...../....)0....{0.....0.....0.....1.....1.....1.....1....s2.....2.....3....i3.....3.....4.....4....D4.....4....05....l5.....5.....6....t6.....6.....6....c7.....7....48....G8.....8....99....~9.....9....1:.....:.....:.....;....q;.....;.....;.....<.....<.....<....7=

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\gu.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1247969
                                                                                                                                                        Entropy (8bit):4.3234098874611675
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3072:dYXCzHrul8BRuh7x4kvm/RbIwjAwREJKVMjNiT7llj63rFulPCaSi5NAWsWi//Go:SgruQuhd4kOv0wv5qdhX11oG
                                                                                                                                                        MD5:6C949199EAAAD8FCB12C38EC6C02D758
                                                                                                                                                        SHA1:CE4DBD5E6A37F25354EC6849F7008956EF3568BA
                                                                                                                                                        SHA-256:966591A74E44C75C7F0114BB8E36B0E9F5502AEBDC96C714C8A8F6D45BC863C8
                                                                                                                                                        SHA-512:3344E0083969DE6F4913893A14586B441F65CB5D45F913F1CEA61B8D5ABBDB3B1C18A48731870282174263C1F306ED6B99C279627BD269E89CD4E15DC3D88313
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.....j.....k.)...l.4...n.<...o.A...p.N...q.T...r.`...s.....t.....v.....w.....y.....z.\...|.....}.........................................................................8.....]......................."...........B.....5...........y.......................p.................7 ..... ..... .....!....."....h"....."....H#.....#....2$....R$....5%.....%....P&.....&.....'.....(....,)....n)....D*.....+.....+.....+.....,....k-.....-.........../.....0.....0.....0.....1.....2.....3.....3....q4.....5....F5....m5....&6.....6.....7....C7.....7.....8.....8.....8.....9....s:.....:.....;.....;....|<.....<.....<.....=....S>.....>.....>....g?.....@....n@.....@....@A.....A....KB....jB....}C.....D....2E....hE....!F.....F....(G....QG.....G....VH.....H.....H....WI....8J.....J.....J.....K.....L....JM.....M....oN.....O....RO.....O....gP....-Q.....Q.....Q.....R....zS.....T....<T....cU.....V....^W.....W.....X.....Y.....Z....fZ....R[.....\.....\.....\.....]....I^.....^.....^....._.....`....ta

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\he.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):769483
                                                                                                                                                        Entropy (8bit):4.624517967326664
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:HwRkrhVzCDkVF2TWrqnV3mWqu/rHQxssACnX+8eQCajZ5Q69Zt+yr4w5ONmmEkcU:QU5J+f
                                                                                                                                                        MD5:16562C59FBA469E1DD2F3B0B87A64645
                                                                                                                                                        SHA1:9A6863205FCA8EA6D09A98B8E8DAB543FF6198A1
                                                                                                                                                        SHA-256:64FA2E98A9056E23C3A934FF39FEF81C306CEC5844D56DDA17EC6C25FCDB1B5A
                                                                                                                                                        SHA-512:DBB6E1A5E52A005386007F88B53109037792BC7B65FB95ACE3E8CC5AE3EBD8320C7E406381C375BF751A9265ACE84E0BBE1301D4BF3AA79200EC789DC3B3BC0B
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.F...t.]...v.....w.....y.....z.....|.:...}.k.........................................................................................0.................(.....J...........H................._...........R.....r...........z.................p.........../.....@...........#.....R.....t...........o.................v ..... ....D!....h!.....".....".....".....#.....#.....#....=$....T$.....$....Y%.....%.....%....|&.....'.....'.....'....2(.....(.....(.....(....m).....).....*.... *.....*....<+.....+.....+....&,.....,.....,.....,....n-.....-....".....7............/....X/....i/...../....Q0.....0.....0.....1.....1.....1.....1....|2.....3....T3....s3.....3....[4.....4.....4....%5.....5.....5.....5....^6.....6.....7....67.....7....I8.....8.....8....>9.....9.....9.....9....R:.....:.....:.....:.....;.....<....d<.....<....\=.....>.....>.....>....X?.....?.....@....P@.....@.....A.....A.....A....wB.....B.....C....3C.....C....vD.....D

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\hi.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1316094
                                                                                                                                                        Entropy (8bit):4.298990624339052
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3072:Pk/xu63zEz67Esk0GjV/BB0ZV1dKu4lYvD6OEOTByntDPtDlZpfRQhs4fe/8bR8E:8/xt3zEMEn0WXo5CKMhZQ
                                                                                                                                                        MD5:6AA92C296ED09FE2AA94DC060B25774A
                                                                                                                                                        SHA1:7619ED3DC5B1E04C55B0EE7280AC2D0135EB9C80
                                                                                                                                                        SHA-256:0C771C66DB4F80A62912564944C4E239F8DAC8381A06483ECAB512E0D75744A1
                                                                                                                                                        SHA-512:9255A4FFEF7BE07CEAB5DD8F46365B9A52D621AE175C1022BB4685FE4F3EA63425F45AA9EF824B467B9C33C51A7104258E888E8EC15C88FEA126BF0B5337FF14
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:........_(..e.|...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.-...v.b...w.....y.....z.....|.....}.;.....d.....i.....q.....y.................................................................E.....~...........X.................v...........;.....i...........x.................. .....!....N!....!"....."..../#...._#.....$.....$.....%....5%.....&.....&.....'....\'.....(....e).....).....*.....*.....+....',....P,....7-.....-....e............/.....0.....1....O1.....2.....3....L4.....4....`5.....6....f6.....6....J7.....7....N8....y8.....9.....9.....9.....9.....:.....;.....;....,<.....<.....=.....=.....>.....>....{?.....?.....?.....@....;A.....A.....A....cB.....C....uC.....C.....D.....E....%F....UF.....G.....G.....H....5H.....H....QI.....I.....I....iJ.....K.....K.....K.....L....ZM.....M....4N.....N....zO.....O.....O.....P.....Q....TR.....R.....S....:T.....T.....U....qV.....W.....X.....X.....Y.....Z....$[....f[.....\.....].....^....m^....a_.....`.....`.....`.....a.....b.....c

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\hr.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):594999
                                                                                                                                                        Entropy (8bit):5.5194556553046565
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:ISmsqAZ/pqidI7/Rw6GhT0ww57V9YMrbLPDK:ISm/iEidI7/Rw6q0B5jYAzK
                                                                                                                                                        MD5:FDA338824B4171B10DCC3395A549FA9F
                                                                                                                                                        SHA1:EA42C8B18228E0CA57B8ED7ED48E3A2AEBE08486
                                                                                                                                                        SHA-256:43F370368B322CD1236632C82AA0E231965DC58FDD497F8AEAE6B40EEF9EE611
                                                                                                                                                        SHA-512:9115F805F51F45839E0A87CF44C1CCE311CECAF717C0DA7DB3B6DA85CEA95F24638AF29DA43BC01056994B22049DAA0387CD4371C13B8E5399FE8F4E38771D57
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.$...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...q.....r.....s.....t.....v.....w.6...y.]...z.....|.....}.........................!.....).....0.....7.....>.....?.....@.....B.....N.....Z.....h.....y.......................#.................'.....<...........3.......................s.................".............................f.......................r.................O.................<............ ....L ....d ..... ....(!...._!....s!.....!....["....."....."....U#.....#....B$....e$.....$.....%....:%....V%.....%.....%.....&.... &....f&.....&.....&.....&....D'.....'.....'.....'....H(.....(.....(.....(....G).....).....).....)....H*.....*.....*.....*....,+.....+.....+.....+....<,.....,.....,.....-....j-.....-.....-.....-....T.......................2/...../...../...../....F0.....0.....0.....1....{1.....1.....1.....2....v2.....2.....3.....3.....3.....3....P4....m4.....4....y5.....5.....5....b6.....6.....7....-7.....7.....7.....8....08.....8.....8.....8.....8....j9.....9.....:

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\hu.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):640919
                                                                                                                                                        Entropy (8bit):5.644940180075165
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:oeo/GHgmRXxhsRd9gHo2pKJDAxukitluTd5kt8zZ9pwJcYNV9SLg+4ev6DbnjDiw:Ho/GBwHAZd5kt8Ex9y+O5LG9b
                                                                                                                                                        MD5:7ADD28FBBBA1CE87972F6433862DCBAA
                                                                                                                                                        SHA1:8B4B0053663C0B69BECA59FACA79854A89AB9C97
                                                                                                                                                        SHA-256:DD86976D72F3CB644B90C1863E29E2F8616B09AC4ACFE9301FB346FA0D87BD78
                                                                                                                                                        SHA-512:EFED0891B0202BAE9396DF54F141A73BB6CCADD7947330FD9E6A3A8911E9E037454238C4BD2BB9075AF3218230C9E4E394F83A70878396911FAA282D99FDD884
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.D...t.[...v.....w.....y.....z.....|.8...}.i.....................................................................................................~.............................L....._...........c................._.................'.................(.....9.................H.....i...........i.................s...........X ....| ..... ....b!.....!.....!....!"....."....."....."....s#.....#....6$....P$.....$....s%.....%.....%....\&.....&.....'....-'.....'.....(....,(....D(.....(.....)....G)...._).....).....*.....*.....*....U+.....+....+,....A,.....,....L-.....-.....-............................Z/...../.....0....B0.....0....W1.....1.....1....#2.....2.....2.....2....J3.....3.....3.....3....`4.....4.....5.....5.....5.....6....i6.....6.....7....U7....y7.....7.....7....T8.....8.....8....(9.....9.....9.....9.....:....,;.....;.....;....R<.....<...."=....V=.....=....e>.....>.....>....8?.....?.....?.....?....q@.....@....'A

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\id.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):529383
                                                                                                                                                        Entropy (8bit):5.3800306514954634
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:MB38e1B6x8b+tQqAHcAef+eVnjHF/TmiZAWO5AVpWOBhUnNiT8kLHp:MB38erqPA2VnjHFbm8At5AVpLp
                                                                                                                                                        MD5:CFC848689A25F5E2E6BA9A06E09B6EE0
                                                                                                                                                        SHA1:35131E775D98A57FFCBD6A75E69F6F67437636C3
                                                                                                                                                        SHA-256:EC1D7BBE064656DC53F70E3A612A582F5D5D0AF5F0C2D6A783796CFFA5BF7F57
                                                                                                                                                        SHA-512:D5A027E35DD3846F5255B81EED36A3498AC9D809367692B2DA216B5771C2D54FAD35FC15C15705A2BBB4A7B35DD2245661882734998F9BC3AD8D62D2273B6577
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.....j.....k.(...l.3...n.;...o.@...p.M...q.S...r._...s.....t.....v.....w.....y.-...z.[...|.....}......................................................................... .....-.....=.....O...........5.....}.................6.....c.....o...........6.....y.................P.......................K.....{.......................=.....T.................B.....f.................P.....g.................4.....A.......................#.................$ ....7 ..... .....!....W!....k!.....!.....!....."....."....g"....."....."....."....-#....x#.....#.....#.....$....Y$.....$.....$.....$....>%....m%....w%.....%.....&....B&....L&.....&.....&.....'....('.....'.....'.....(.....(....q(.....(.....(.....)....Y).....).....).....).....*....T*....s*.....*.....*....2+....]+....p+.....+.....,....G,....i,.....,.....,.....-.....-....w-.....-.....-..........v................../...../.....0....f0....u0.....0....?1....y1.....1.....1....F2....t2.....2.....2.....3....,3....<3.....3.....3....24

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\it.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):581016
                                                                                                                                                        Entropy (8bit):5.296715563664076
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:Mkqu5NjNJ2IU9UTx994eN7NgvESIqRRxsO1ytnvWjRT9Tj+rhazYDxrvAqpzSw9S:MkSLlZm128uJekfzEpe5kLISa
                                                                                                                                                        MD5:6AA3BC3EE4999C324B82E50940E62C74
                                                                                                                                                        SHA1:10AF8030FC2F875E133C9417E0221528160AD8B5
                                                                                                                                                        SHA-256:73CC8422643A65753B2C3672C8F8331EE92C9BDDC912576554E95B0986CF990D
                                                                                                                                                        SHA-512:F039EF32002E55D09A4F567CC81FE2B3B329D517C985436A5DA121FF0E6AC7E258B5D1FDDA81E6C1578DAF7078B91ABCFB7DA98CDBA6693D4FBE7F28115E6971
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.....j.....k.....l.!...n.)...o.....p.;...q.A...r.M...s.|...t.....v.....w.....y.....z.I...|.p...}...............................................................................".....;.....L...........u.................d...................................r...................................G............................._.......................v................._.................S..........." ....h ....y ..... ....9!....s!.....!.....!....`"....."....."....G#.....#.....$....,$.....$.....$.....%....$%....t%.....%.....%.....%....@&.....&.....&.....&....#'.....'.....'.....'....+(....~(.....(.....(.....)....Y).....).....).....)....-*....[*....d*.....*.....+....:+....E+.....+....,,....z,.....,.....,....6-...._-....x-.....-.....-.................................../...../...../..../0....l0.....0.....1....31....H1.....1.....1.....2....!2.....2.....3....Y3.....3.....4.....4.....4.....5.....5.....6....[6.....6.....7....r7.....7.....7....!8....a8.....8.....8.....9....c9.....9

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\ja.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):708098
                                                                                                                                                        Entropy (8bit):5.712005061370792
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:SCG5Mw77QWN7v5DD79ZgQ21XymbA5zFLdbvVt:SrSw7NN7F9ZgQ21Xi5zFLdj
                                                                                                                                                        MD5:5A69547F56DC61E482DCDA1CE704C5AC
                                                                                                                                                        SHA1:5B7BBC8E9B14D78F2105136AFB7728050128C02E
                                                                                                                                                        SHA-256:A286A5FAF9021927EC09FD8CBF30ED14AD59C3BAA36D29E5491AD27B957915E5
                                                                                                                                                        SHA-512:2B9D020544201E2D0B0B44B0977FCBAB858563969CE02BE65689C5F5B780ADC4560DF523589293CD66F42903322ED61D781DA093ADFA44AA0681A28D97DE4556
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........'..e.f...h.n...i.y...j.....k.....l.....m.....o.....p.....q.....v.$...w.P...y.w...z.....|.....}.......&.....+.....3.....>.....F.....U.....Z.....b.....i.....p.....w.....y.....~.........................................l...................................p...........S.....n.....4...........P.....{...........k.......................|.................H............................. .....g.................h ..... ..... .....!.....!.....!.....!....6".....".....".....".....#....4$.....$.....$.....%....w%.....%.....%....;&.....&.....&.....'.....'....%(....l(.....(....4).....).... *....D*.....*....I+.....+.....+....#,.....,.....,.....,....j-.....-..........+...........6/...../...../....80.....0....(1....G1.....1....A2....{2.....2.....3.....3.....3.....3....Z4.....4.....5....35.....5....?6.....6.....6....*7.....7.....7.....7....B8.....8.....8.....9.....9.....9.....:....5:.....:....|;.....;.....;.....<.....=...._=.....=.....>.....>.....>.....>....z?.....?...."@....>@.....@....LA.....A.....A

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\kn.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1424056
                                                                                                                                                        Entropy (8bit):4.241400387342817
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:X3WMqESgQzb4OpsJHVLl6S3AE745LmWA4hqSm2G:Nqed65qWo
                                                                                                                                                        MD5:52A0707A70B939BCD75B0838A5DC5357
                                                                                                                                                        SHA1:EB9E1350D9D217580B1939302D008DC07C3B781C
                                                                                                                                                        SHA-256:B177EDA102B1BE8C53127E3BB47970A3C1E2032BE24900D8A126C5F0F077EF3D
                                                                                                                                                        SHA-512:D5FE69035338C4308F661FA0AC25C4A811A6014F6BD85CCC7AD947F76AECF76F67208512E1266E249EC067A5FB22FB74A3550B0F3AEB1BC50FADB3A9D3CC67E4
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.B...h.J...i.[...j.g...k.v...l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.T...y.{...z.....|.....}.......*...../.....7.....?.....G.....N.....U.....\.....].....^.....c.......................].............................D.....L...........[.................. ..... .....!....."....`#.....#....\$.....$....S%.....%....t&....='.....'.....'.....).....)....t*.....*....5,....D-..........|....../....V0.....0....%1....42.....3.....3.....3....,5....B6.....7....T7.....8.....9.....:....C;.....;....u<.....<.....<.....=....C>.....>.....>....X?.....?....A@....V@....9A.....A....zB.....B.....C....BD.....D.....D.....E....EF.....F.....F.....G....sH.....H.....I.....I.....J.....K....CK....eL....dM....$N....SN....6O.....O....TP.....P....AQ.....Q.....R..../R.....S.....S....1T....cT.....U....SV.....V....hW....PX.....X....UY.....Y.....Z.....[....*\....|\.....].....^....W_....._....+a.....b.....c.....c....;e....9f.....f....og.....h.....i....2j.....j....Lk.....k...._l.....l.....m.....n....`o

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\ko.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):599188
                                                                                                                                                        Entropy (8bit):6.077314293748852
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:Twg3X8cvlA/t0ZTvIXzxMSAG0GlzRXhw3zTt8Onat7DXCqYwHs5Ra1i7vlq5zULq:TH75vKpCWj
                                                                                                                                                        MD5:4B563EB612D4FADC6BD8A4C918006AB1
                                                                                                                                                        SHA1:4B9E414AF0C044C4487D1439D23EF11B0169D308
                                                                                                                                                        SHA-256:E0D4461452607E0F4A619EFE653EC9EC39F7D34A742AE98374B2BCE0B821ADC9
                                                                                                                                                        SHA-512:B8C56D69FA41AD14F7197ACAB1BA987EBB06C5B15748E21CEC27861721545E30FB20F76F2C3A752C8EA94CCA1E6B4FAB7FB0727B679A8FB8E94DB2D5C028E7A6
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........'..e.....h.....i.%...j.0...k.\...l.d...m.l...o.....p.....q.....r.....s.....t.....y.'...z.U...|.|...}.........................................................................+.....;.....N.....^...........Q.................(.......................[.................#.................5.....I.................<.....L.................?.....R.................B.....]...........;.....p.................?.....m.....z...........1.....].....j...........<.....t............ ..... ..... ..... ....P!.....!.....!.....!....0"....~".....".....".....#....Y#....~#.....#.....$....r$.....$.....$....3%.....%.....%.....%....>&.....&.....&.....&....E'.....'.....'.....'....B(.....(.....(.....(....`).....).....*..../*.....*.....*.....*.....+.....+.....+.....,.....,.....,.....,.....-.....-.....-..........L.....|............/...../....+/...../...../.....0....(0.....0.....0.....1....-1.....1....+2....q2.....2.....2....X3.....3.....3.....4....h4.....4.....4.....5....]5....}5.....5.....5....R6.....6.....6.....7

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\lt.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):644262
                                                                                                                                                        Entropy (8bit):5.6356477666035865
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:kjFt+0US0MAcrMqecJwuxZ5b7MjC3jqt6S0M:WFQ0GMnrLZ5sjIjqN
                                                                                                                                                        MD5:7CEF6E31D76861DB4D7D622FDD89E5AA
                                                                                                                                                        SHA1:31FA45C3B7666259D4D8A13518ECE423A97EDCCA
                                                                                                                                                        SHA-256:2F1E1C69DA5CAD8F47E45AF0AC47CEC90C20FE2897A43CB496C7FEED1EC5D1AB
                                                                                                                                                        SHA-512:DF66A739F3A8DA62A942B56B23F71A2B68469E87DC44EB8CE1A9A859A609F1DB4BEE2497DEFEF06FA48E14CF461E61410668A5216459C94C79F4B69A3CF092F6
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.#...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.C...z.q...|.....}.................................................$.....%.....&.....(.....6.....C.....W.....h....................... ...........6.....}...........0.................$.................S.....m...........f.................$.......................w...........%.....J...........] ..... ..... ....5!.....!.....!.....!....j".....".....#.....#.....#....F$.....$.....$....7%.....%.....&....3&.....&.....'....<'....W'.....'....:(....j(....|(.....(....h).....).....)....(*.....*.....*.....*....m+.....+....',....6,.....,....4-....o-.....-............................6/...../...../...../.....0....%1....x1.....1.....2....|2.....2.....2....W3.....3.....4....<4.....4.....5....d5....|5.....6.....6.....6.....6....l7.....7.....7.....8.....8....19....s9.....9....$:.....:.....:.....;.....;....T<.....<.....<....G=.....=.....>....)>.....>....[?.....?.....?.....@....r@.....@.....@....+A.....A.....A

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\lv.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):643309
                                                                                                                                                        Entropy (8bit):5.637177021245093
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:Uz9waCt7x2/28mvsf4xN3tVF89voxEJiiUh/7bOEw5hp1UrFeTE/CoCKbnh2Degl:UFuKvNMEGFOEw5WFeTunbf35S
                                                                                                                                                        MD5:00B517CE675A3089823708776C6F9302
                                                                                                                                                        SHA1:2BC24F150ADAAFD2604C5D95BBAAF8DC983D7DA2
                                                                                                                                                        SHA-256:0ADEDD1EAAF902FEEBB208220D9F21AE1B0175E74F6A966CD7ED226146D86AE8
                                                                                                                                                        SHA-512:6C19A0D779185141FB050369F9FBFE60D0B838E55E2674E3F14A67E1A6970727E329656E458CA8516A41C97B20E67EB1789587AF957129B3D32C94A3536AB12E
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.2...w.^...y.....z.....|.....}.......4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....j.....}.......................\...........k...................................\...........R.....o.............................:.......................j...........2.....D...........4.....f...........% ..... .....!....A!.....!....B".....".....".....#.....#.....#.....#...._$.....$....E%....b%.....%.....&.....&.....'....X'.....'.....'.....(....b(.....(.....(.....)....n).....).....*.....*.....*....0+....u+.....+.....+....p,.....,.....,.....-.....-.....-.....-....N............/...../...../.....0....G0....X0.....0.....1.....1.....1....K2.....2.....2.....2....`3.....3.....4....=4.....4.....5....15....@5.....5...._6.....6.....6....:7.....7.....7.....7....b8.....8.....9....39.....9....1:....u:.....:....+;.....;....P<....c<.....<....f=.....=.....=....5>.....>.....>.....?....o?.....?.....?.....@.....@....-A....qA

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\ml.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1481376
                                                                                                                                                        Entropy (8bit):4.274098791777635
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:gtUOGVx75aWEyghv479y6DPnXKfhBP1zXnxooG98MF3e7hDK5V6jX9fb3VV:gtuxmGKfhBP1zX23F3ek5V6jX9D3j
                                                                                                                                                        MD5:D32A29A61E8AFABA6B42D236257D9929
                                                                                                                                                        SHA1:9664F50EA7590A47C2EB8EB4A3E49BE556D08F7A
                                                                                                                                                        SHA-256:A59FD15C969EE8FFD7E72F5A2245C6A5A4FC048F7899FCA489D78C8F6394CA1E
                                                                                                                                                        SHA-512:2668976853B26B22859F8C20AFAEB4D641845E94779B8994B49F240302420279E3F9A99666B8F551495B7D5A8C3C83609B7ECF276FABD8345CC8C787319EA3D2
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.@...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.&...w.R...y.y...z.....|.....}.......(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....a.......................j...........<.....+.....x.................B.................] ....L!.....!.....".....#....h$.....$.....%....Y&.....&.....'.....'.....(....t).....).....*....n+.....+....4,.....-..........X/...../.....0.....1....W2.....2.....3.....4.... 5....d5.....6.....7....o8.....8....I:.....;.....<.....<.....=....U>.....>.....>.....?....g@.....@.....@.....A.....B.....B.....C.....C.....D....AE....uE....YF.....F....pG.....G.....H....YI.....I.....J.....J.....K....BL.....L....NM.....N.....N.....N.....O.....P.....Q.....Q.....R.....S.....T....DT.....U.....U.....U....?V.....W.....W.....X.....X.....Y.....Z.....[.....[.....\.....].....^....E^....g_....^`.....`....?a....~b....@c.....c....>d....le.....f....dg.....g.....h.....i.....j.....j.....l.....m.....m.....n.....n.....o....Pp.....p.....q.....r.....s

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\mr.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1222173
                                                                                                                                                        Entropy (8bit):4.300698800250203
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3072:gOG1c9CX6VI4KBYmiMpvVL8lownlWGrInbizwF/yGRu3RxYR3GodgEWYJrOznupW:fG0m4lwcasmKZKbzNvfq1E5imHReZ
                                                                                                                                                        MD5:0E5B29B6AE74A1F94CA4F880F131A79F
                                                                                                                                                        SHA1:6AC5089ACE05847480D2AEEC89954124CAA781AA
                                                                                                                                                        SHA-256:25BF8E86F7C9E88F68D4C40C4F124C16F60DAF22E7A87F55BA2C560A0F640BC9
                                                                                                                                                        SHA-512:30717C0AEF4458BBCF7472316727981829EDADA8BE3003AFD9D65CB01D4CF309F601B1C41539343D6239CB2E9157554C95CF966A4156458A2FD78D2464075C98
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:........q(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.C...t.Z...v.....w.....y.....z.....|.7...}.h...................................................................................-.....z.....................................................R...........U............ .....!....6"....b"....5#.....#....P$.....$....^%....-&.....&.....&.....'.....(.....)....T).....*.....,.....,....5-....S.....V/...../....$0....K1....K2.....2.....3....C4....a5.....6....J6.....7.....8.....9.....:.....;.....;....9<....s<....6=.....=....+>....W>.....?.....?.....?.....@.....A.....A....\B.....B....|C....RD.....D.....D.....E....uF.....F.....F.....G....uH.....H.....H.....I.....J.....J.....K....RL....{M....=N....|N....;O.....O....4P....]P.....P.....Q.....Q.....Q.....R.....S.....T....+T....TU....OV.....V....eW....OX.....Y....mY.....Y.....Z.....[....k\.....\.....].....^....n_....._.....`....Qb....:c....ac.....d.....e...._f.....f.....g.....h.....i....]i.....j.....j....Wk.....k.....l.....m....!n

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\ms.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):554824
                                                                                                                                                        Entropy (8bit):5.250627975386066
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:1fZuPdEaPHdoDKUaxe+2cgFRlWWNxTUcWR95bxlqyGkuBm9ch:xg9HEsxd2hlWEG95vFG3
                                                                                                                                                        MD5:6149507C3AA99C4012D9D7CFE4BC30C8
                                                                                                                                                        SHA1:51A2BB5CBAE64F3877AFC342EA0F43915702F8F4
                                                                                                                                                        SHA-256:DD75481D67D9BE36ECB2E421117395FBB75B7623164F13A09BE1CF3CE76D588F
                                                                                                                                                        SHA-512:71F8DC03618D46BE7B036353526BF20A61E648EF50ADEEEC057D314E9A4536899C37EF691164BF9DE9E10A3867749F8D3D6F4038E16C82CF6122E7AB4A1C7732
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.^...h.f...i.n...j.z...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.;...w.g...y.....z.....|.....}.......=.....B.....J.....R.....Z.....a.....h.....o.....p.....q.....v.............................d...........4.....O.................B.....R...........0.....q.................^.......................f.......................[.......................`................./.......................P.......................- ..... ..... ..... .....!....y!.....!.....!....8".....".....#.....#...._#.....#.....#.....#....!$....t$.....$.....$.....$....G%....n%....z%.....%....A&....{&.....&.....&....I'....~'.....'.....'....?(....q(....{(.....(....-)....])....f).....).... *....S*....^*.....*....A+.....+.....+.....+....B,....g,.....,.....,...."-....F-....`-.....-.....-....(.....9................../....@/...../...../...../...../....U0.....0.....0.....0....e1.....1.....1.....2.....2.....3...._3....m3.....3....<4....w4.....4.....4....I5....w5.....5.....5.....6....;6....K6.....6.....6....&7

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\nb.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):537830
                                                                                                                                                        Entropy (8bit):5.4264919827777245
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:GFxHxFb73kroOp7fBpHXYbhOs5wk+bhPLgg5t:GXxFXkJ1YbhOs5f+bFUG
                                                                                                                                                        MD5:2A0EC73D03D4D7FCEC71AD66CC0D4B30
                                                                                                                                                        SHA1:BB8DF6E11B02086726ECEDE97D5F729F4197323C
                                                                                                                                                        SHA-256:D44EF5E644B1B8F7C056D5E20651515FCC8565BEFEC575091735FB39C6D63554
                                                                                                                                                        SHA-512:CDCB4E436270156E263D731CE243D821C5361B18B6D7B8259875C9D895301D478A87FEB7CAFC3376D09D18D27F32DC403FD2CBD034D68736CB968BBEFEBD642B
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h. ...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.0...y.W...z.....|.....}...............................#.....*.....1.....8.....9.....:.....<.....G.....V.....i..................................._...................................n.................P.......................M.....w.................:.....c.....r...........B.....r.................w.................`...........- ....L ..... ....&!....^!....r!.....!....r"....."....."....m#.....#....J$....l$.....$.....%.....%....'%....}%.....%.....%.....&....`&.....&.....&.....&....I'.....'.....'.....(...._(.....(.....(.....(....a).....).....).....*...._*.....*.....*.....*....Q+.....+.....+.....+....`,.....,.....-....5-.....-.....-................x................../....[/...../...../...../....b0.....0.....1....F1.....1.....1.... 2....92.....2.....3....23....J3.....3.....4....J4....^4.....4....95....u5.....5.....6.....6.....6.....7....o7.....7.....7.....8....Y8.....8.....8.....8....<9.....9.....9

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\nl.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):556268
                                                                                                                                                        Entropy (8bit):5.362124110769206
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:jVAWY0lbJ9WQusFUiFgN5tmDdx5btfKzaWDZqqn9pmTy:qWY0lbJ9WQusFU15tmDdx5bFKzaWVqq1
                                                                                                                                                        MD5:E8B790166D701F63A60C3B322FCCE234
                                                                                                                                                        SHA1:61EC318AA8030F7D29C3258126B156D1D3EEFA2C
                                                                                                                                                        SHA-256:3D73B0110E5832B6A7C7B7E64018368464EF8552D6A98592D0ADBF713EB9755E
                                                                                                                                                        SHA-512:4E4B299CB55CBB5906FF974BB5E5078D2018298B5EE6D9CA0E40AAB8DB542AAEDC4BD7A5DB242A2C5194BC90C07631F627043DCC1A9F2D095A28C3E35F212DD9
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.....j.....k."...l.-...n.5...o.:...p.G...q.M...r.Y...s.....t.....v.....w.....y.'...z.U...|.|...}...............................................................................(.....9.....K...........m.................W.......................{...........3.....I.................L.....c.................7.....F.......................(.................7.....X...........0.....g.................E.....z.................T ..... ..... .....!.....!.....!.....!....[".....".....#....3#.....#.....#.....#.....$....X$.....$.....$.....$....,%....}%.....%.....%.....&....|&.....&.....&.....'....u'.....'.....'.....(....U(.....(.....(.....(....4)....`)....m).....)....)*....]*....l*.....*....H+.....+.....+.....,....W,.....,.....,.....,....=-....^-....u-.....-....+.....S.....e...........7/....n/...../...../....<0....Z0....n0.....0....21....d1....u1.....1....G2.....2.....2....-3.....3.....4.....4.....4.....5....D5....i5.....5....46....e6....z6.....6.....7....A7....Q7.....7.....8....A8

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\pl.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):619265
                                                                                                                                                        Entropy (8bit):5.770526396702215
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:zifPIC1WoOB/ktv/XfQfuzSJY9HQbyDPSCUd4e3m7UyMgmx1QhH1b5FuH4VZy:YTxbMJ1Qh15w
                                                                                                                                                        MD5:8A4354163FF3B0978A568F781BDAC289
                                                                                                                                                        SHA1:45DE421F35AF79ADF962809CF8D0E6D2ADBCB553
                                                                                                                                                        SHA-256:2F6DE0F9A46AE0B75BEB67E09FFEEE12483842A7CD6F2A2382CCBE36FBFC17E3
                                                                                                                                                        SHA-512:5760F20228AFE74E9FF2A916A168E8CC2D4A64D8E76065E61A7A60616A473C7DC3DA4805125B270F179B7A0F291071E81D761D82EEC3B130D552B57ABD76C127
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i./...j.9...k.H...l.S...n.[...o.`...p.m...q.s...r.....s.....t.....v.....w.&...y.M...z.{...|.....}..................................... .....'.........../.....0.....2.....A.....O.....d.....y.........................................%.....8...........M.......................u................./.......................(.......................I...................................I.....n...........8 ....p ..... ..... ....M!.....!.....!.....".....".....".....".....#.....$....d$.....$.....$....$%....9%....Z%.....%.....%.....&....&&....o&.....&.....&.....&....O'.....'.....'.....'....](.....(.....(.....(....Y).....).....).....)....J*.....*.....*.....*....:+.....+.....+.....+....Q,.....,.....-....+-....y-.....-.....-.....-....Y.......................E/...../...../...../....g0.....0.....1....@1.....1.....1.....1.....2....s2.....2.....2.....3.....3.....3....+4....E4.....4....85.....5.....5....%6.....6.....6.....7....c7.....7.....7.....7....@8.....8.....8.....8....$9.....9.....9

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\pt-BR.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):581655
                                                                                                                                                        Entropy (8bit):5.426534241883623
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:mHM4QhMCJi4wNNBXBLGfs9y+z5GHNXun0msRgMpI2:CchHi4wD50XosR9pN
                                                                                                                                                        MD5:B1AB7D7AA67A7B61BFA9AEBAD0B812AF
                                                                                                                                                        SHA1:95EFF4BE517C0A25C34578DEF10D48C77021DE1A
                                                                                                                                                        SHA-256:5BD503C413AAF8FA87FD47C341D437ACCC25397A50B082068BCF2F3BB4FB27C7
                                                                                                                                                        SHA-512:8498FE7727771DF3C1EB34560C1E25B0C30690C7C921104B4ADCF04CC5753462BAC513A60A5833CB6F57733201D4883605F8A4EC4A457F3EBC7C952090B1A9E1
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.-...j.9...k.H...l.S...n.[...o.`...p.m...q.s...r.....s.....t.....v.....w.&...y.M...z.{...|.....}..................................... .....'.........../.....0.....5.....G.....W.....y.............................%.................%.....5...........R.................4.......................6.............................r.................G.................'.................d................._ ..... ..... .....!....}!.....!.....!....J".....".....#....!#.....#....-$.....$.....$.....$....>%....d%....w%.....%.....&....d&....s&.....&....+'....`'....n'.....'....4(....o(.....(.....(....-)....^)....j).....).....*....:*....D*.....*.....*.....+.....+....}+.....+.....,....$,.....,.....-....q-.....-.....-....'.....K.....`................../....y/...../...../.....0.....0.....1....F1.....1.....1.....2....-2.....2.....2.....2.....3.....3.....3....(4....D4.....4....D5.....5.....5....A6.....6.....6....'7.....7.....7.....8.....8....e8.....8.....8.....8....`9.....9.....:....!:.....:

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\pt-PT.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):585544
                                                                                                                                                        Entropy (8bit):5.398721361990628
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:EdZCITRW+kQdJs7ieJVJJxhbHMm5wfBCV5z6jPdoSR7oF:6XJksvMV5+jPSSR7Y
                                                                                                                                                        MD5:CBE5E35F844F5F1400DF3685CC847694
                                                                                                                                                        SHA1:E60CDB0A813A97C8548C878276BFAE155350BB42
                                                                                                                                                        SHA-256:6B9BD714D217D596183894FFED3174A617E1C8CFAE292231D4B967183B589C6B
                                                                                                                                                        SHA-512:96046C97436A3DBF5AAC479B9EAA9DFDCFC81F1EDCAEE9CD65D59BEB0CE6B6B42828E0D170AAEF2EF1D68988F7916AC1DBAC0D84218DE83FEDCCA8592DE4C1F1
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.X...h.`...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.>...w.j...y.....z.....|.....}.......@.....E.....M.....U.....].....d.....k.....r.....s.....t.....y.............................U...........=.....Z...........%.....p...............................................8.....\.................).....9.........................................O.....}...........].................- ..... ..... ..... ....L!.....!.....!....."....i".....".....#....3#.....#....)$.....$.....$.....$....U%.....%.....%.....%....C&....t&.....&.....&....F'.....'.....'.....'....V(.....(.....(.....(....W).....).....).....)....:*....g*....q*.....*.....+....@+....J+.....+.....,....5,....F,.....,....$-....t-.....-.....-....4.....^.....z................../....$/...../...../.....0..../0.....0.....1....U1.....1.....1.....2....H2....Z2.....2.....3....>3....S3.....3.....4....b4....|4.....5.....5.....5.....5....u6.....6....,7....P7.....7....38....s8.....8.....8....'9....L9....a9.....9..../:....k:

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\ro.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):606335
                                                                                                                                                        Entropy (8bit):5.4540537912984615
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:kxrPkiHXWrfGENd49ow6q0gdKXKkQGXq5e3jUZGs2hj/Xrbf:CrxXWr3Nu9o7qHKasq5ezUuj/3f
                                                                                                                                                        MD5:5DB10EDF772656C0808DD8DA698334BF
                                                                                                                                                        SHA1:3CAF7C9D5A3B44E06E0588DABA698B6970EA06F5
                                                                                                                                                        SHA-256:73B6A63352906D77196F38A1DF937EC0770160FB7A93321867C7994ED3E7967B
                                                                                                                                                        SHA-512:EB253B548C7F574943136764A23818F9DEDEA17FF42F92DC8591F4B7C297ACCDDE9F6B2C0AD96F1FD0815C53940C0102A90C603F9F4D6D9C8FB053B559CC7A62
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.!...j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.?...z.m...|.....}................................................. .....!.....".....$.....3.....?.....M....._...........w.................P...................................T.....s...........\.......................g.......................C.....l.................a.................N................."............ ....H ....a ..... ....$!....X!....m!.....!....C"....."....."....0#.....#.....$.....$.....$.....$.....$.....%....W%.....%.....%.....%....(&....u&.....&.....&.....'....e'.....'.....'.....(...._(.....(.....(.....(....G)....q).....).....).....*....C*....S*.....*.....+....4+....H+.....+....@,.....,.....,.....,....G-....f-....|-.....-..........7.....[............/....K/....^/...../....O0.....0.....0....&1....i1.....1.....1.....2....x2.....2.....2....B3.....3.....3.....3....g4.....4....95....R5.....5....C6.....6.....6....&7.....7.....7.....7....*8....t8.....8.....8....,9.....9.....9

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\ru.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):996315
                                                                                                                                                        Entropy (8bit):4.845331047532895
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:4I6pfQjRo4YSWPAY+zJ9LF1WAati/16HzW/yqSvDsNL4kXew+YHVeXN2hVO3j/iH:4T25H3Oc
                                                                                                                                                        MD5:E9AF20A6226511CD535888846A2BB16F
                                                                                                                                                        SHA1:739A46269F334ECC291BAE6777F0B7C8E271E4C0
                                                                                                                                                        SHA-256:5DB640C6C288D9FC79012A7670301A3BC463359C17BA200AEDAA56260EF8D955
                                                                                                                                                        SHA-512:7897C500718382F08D55F3CDDD96D1451524B5C2B8FEBC65E1700A645598B622C819EC66E4A21C119F044FAAA525A2ABDDDF66D0C9800AF6ECEA9CEB217A88BB
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(d.e.....h.....i.....j.....k.....l.....n.....o.....p.%...q.+...r.7...s.f...t.}...v.....w.....y.....z.3...|.Z...}...............................................................................$.....<.....c.....X.....$...............................................D.............................G...........0...........8.....[.................Q.....h...... ..... .....!....J!....=".....#.....#.....#....z$.....%...._%.....%....;&.....&.....'....A'.....'.....(....#)....P)....T*....N+.....+.....,.....,....0-....]-.....-............................_/...../...../.....0.....0.....1....X1....}1....#2.....2.....2...."3.....3....%4....`4....w4.....4....t5.....5.....5....B6.....6.....6.....7.....8.....8...._9.....9.....:.....:.....:.....:....T;.....;.....;.....;....|<.....=.....=.....=.....>.....?.....?.....?....|@.....@.....A.....A.....A....GB.....B.....B.....C.....C....mD.....D....jE...."F.....F.....F.....G.....H.....I....lI.....J.....J.....J.....J....xK.....K....&L....?L.....M.....M....4N

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\sk.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):626605
                                                                                                                                                        Entropy (8bit):5.815043408006658
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:6fKTvoktDh40i/igVQm5611wYZLtWTjsxt9Wl:6KTdjib5ewsPtIl
                                                                                                                                                        MD5:B0BBB6661370D27B6600EBE98CADB9AC
                                                                                                                                                        SHA1:1139852DA47048F15C16EB101DAC86DFC8F652BA
                                                                                                                                                        SHA-256:E0FE4130E668AC659D5334C5BC8CDE70BBA8742273B5965836860B5A8B1B016A
                                                                                                                                                        SHA-512:C8EAC323552F873EC088F77B8C46522387B0298B6D566CF8AA173FA9B2D66389068BB26E46044AF2FAA4224B39DC748164843B58B99E9DDE093FCB32AFB5FED0
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.....j.:...k.I...l.T...n.\...o.a...p.n...q.t...r.....s.....t.....v.....w.'...y.N...z.|...|.....}.....................................!.....(...../.....0.....1.....3.....G.....O.....a.....v.....2...........N.....l...........M.................'.........................................6.................4.....G.................).....=.................K.....p.............................z ..... ....,!....E!.....!....("....^"....o"....."....v#.....#.....#....d$.....$....B%....]%.....%.....&....3&....H&.....&.....'..../'....A'.....'.....(....)(....;(.....(.....)....Y)....o).....)....L*.....*.....*.....*....X+.....+.....+.....+....u,.....,.....,.....-.....-.....-.....-....s...........D/....\/...../...../.....0....+0.....0.....0.....0.....1.....1.....1.....2....#2.....2.... 3....e3.....3.....3....C4...._4....t4.....4....R5....y5.....5.....6.....6.....6.....6.....7.....8.....8.....8.....9.....9.....9.....9....O:.....:.....:.....:....L;.....;.....;.....;...._<.....<.....=

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\sl.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):601837
                                                                                                                                                        Entropy (8bit):5.489524001909229
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:mZ9VfcB2z/i1SE5vqfCWJU171i/fzSjqc:mHVBWSE5vqfmi/fzSl
                                                                                                                                                        MD5:AA7C0F35B61A230D65E498DAAB67388C
                                                                                                                                                        SHA1:F60CB1C7128A1FB1CFD9AA029F96DF36033777D0
                                                                                                                                                        SHA-256:03AFC83CDBA98C08AF169C8AE111AA916F3EE6D5A2FEE4954EF35ECC063F2B21
                                                                                                                                                        SHA-512:048D03C490F18D22F4900363F9C4ABEE037A2029F226C90806064FFEDC85B07A1D86225B9C534311B08F588632A84221D7E4FA355E7B768CFDFD6102C5FFE705
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.....j.....k."...l.-...n.5...o.:...p.G...q.M...r.Y...s.....t.....v.....w.....y.'...z.U...|.|...}...............................................................................,.....<.....O...........n.................J...................................N.....m...........9.....m.................8.....c.....p...........+.....V.....e...........G.....|........... .......................]............ ..... ..... ..... ....%!....9!.....!....3"....j"....."....$#.....#.....#.....$....v$.....$.....$.....$....T%.....%.....%.....%....?&.....&.....&.....&....K'.....'.....'.....(....n(.....(.....).....).....).....)....;*....P*.....*.....+....:+....M+.....+.....,....B,....Q,.....,....,-....i-.....-.....-....8.....X.....p............/....;/....V/...../.....0....\0....n0.....0....O1.....1.....1.....2....l2.....2.....2.....3....x3.....3.....3....34.....4.....4.....4.....5..../6.....6.....6....j7.....7....@8....}8.....8....T9.....9.....9.....9....;:....Y:....i:.....:....I;.....;

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\sr.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):924863
                                                                                                                                                        Entropy (8bit):4.7696519516761695
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:nP3ydDCzsexx7UinNLQIlApSld7vwFi4CBaAwH5YvTEquCxa4F37nyIzy/k/S:P3G2zBTfWt5suBr
                                                                                                                                                        MD5:ABDD9EB966D915C1896B31CBA0B2656B
                                                                                                                                                        SHA1:CB0080E5F2C168CD0F3EDC6ED6C47734FFD67790
                                                                                                                                                        SHA-256:3913D3BE5016CE873AC68AF376D5FCF558BB5F5F29A9BC56DF0099BA47E52486
                                                                                                                                                        SHA-512:BCB258D6DA766BB6F00DFDBB03BC878000D9CF28B2B707375CE52485DB9C530A34D1528A1473F09B5765BC57ABD847F191BDE55646EB707443CD0E40509B70E1
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e. ...h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...q.....r.....s.....t.....v.....w.2...y.Y...z.....|.....}...............................%.....,.....3.....:.....;.....<.....>.....h................................... .....R.................#.....F.....A.............................M.......................) ....| ..... ....(!.....!.....!.....!....."....b#.....#.....#.....$.....%....=&.....&....C'.....'....B(....k(....').....).... *....E*....++.....+....b,.....,.....-....y....../....V/...../....V0.....0.....0....B1.....1.....1.....2.....2.....3....G3....f3....*4.....4....+5....V5.....5.....6.....6.....6.....7.....8....Q8....l8.....9.....9.....9.....9.....:.....;....n;.....;....[<.....=.....=.....=....E>.....>.....>.....?.....?....%@....^@.....@....EA.....A....$B....AB.....C.....C.....D....\D.....D....eE.....E.....E.....F.....G....lG.....G....xH.....H....yI.....I.....J....fK.....K.....L.....M.....M....!N....kN....%O.....O.....P....%P.....P.... Q....XQ....uQ....FR.....R....[S

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\sv.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):541025
                                                                                                                                                        Entropy (8bit):5.5401177610527155
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:MnZyPzw0uHrwiTR91Q0Z4IoogVChcxorsl6hI+vRFcz5RtGl2KYF4bkvMrOSOgfm:i8U7DTC0Z4KhJW5krMTMo
                                                                                                                                                        MD5:CC0806219798E3ADE0437219457A37AB
                                                                                                                                                        SHA1:DD6BA47E14B7B0D08159FBCA2409B013DC2E17DE
                                                                                                                                                        SHA-256:79A7260C8651FF3024E21F9263543BF4E9D5F3574E81CF96EDF6388F8DA85CD1
                                                                                                                                                        SHA-512:DF3DA02BB2FECBBAF1AB80AF8EF8B1A7AE9F6C7ED01F94C5A502720376924132C344DD716FC5B4DDC03733A6C3581ED8D8A577154C619BA85C527DC67F4A48C2
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:........p(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.8...t.O...v.....w.....y.....z.....|.,...}.]...........................................................................................................Y.....o...........B.........................................e.......................r.......................r...................................1.....Q...........?.......................].................. ....x ..... ..... ....E!.....!....."....#"....."....N#.....#.....#.....$....n$.....$.....$.....$....O%....t%.....%.....%....-&....S&....b&.....&....2'....i'....{'.....'....6(....d(....s(.....(....()....S)....b).....).....*....C*....S*.....*.....+....H+....W+.....+....*,....e,....z,.....,....%-....E-....^-.....-.....-..........1.....}.......................u/...../.....0....D0.....0.....0.....1....-1.....1.....1.....2....&2.....2.....2.....3....03.....3....44.....4.....4.....5.....5.....5.....5....W6.....6.....6.....6....F7.....7.....7.....7.....8.....8.....8

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\sw.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):570564
                                                                                                                                                        Entropy (8bit):5.341574755821131
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:Evzozr9Cpdjcu25KmedqrCBfRdpG5PbQW49qx2FRyl+Y4jNUkCarOg6jP5AuNskZ:Evk3v15zsI
                                                                                                                                                        MD5:A63EF2C4676DFBEE98E29A84A7AD9D27
                                                                                                                                                        SHA1:2F0F4B33ACF5E63F3159C62C74DEAA9A361203F4
                                                                                                                                                        SHA-256:7B8C51B247DEA72D68CB0EF4292800C13209DA6F859A9AD289C996582F19E65C
                                                                                                                                                        SHA-512:CD65FD2C49D35757DE648F21DEC748FB4A1D13D2308552774FE9C859AD5748B21F5DB449F8B380520F27DC868A3EBAAFD58D4C45ABA34033785777D342E17E6F
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.!...j.-...k.<...l.G...n.O...o.T...p.a...q.g...r.s...s.....t.....v.....w.....y.A...z.o...|.....}.................................................".....#.....$.....).....;.....K....._.....v.............................U...................................L.....b.................I.....].................2.....A.......................).................*.....P...........N.................%.......................3 ..... ..... ..... ....4!.....!.....!.....!....q"....."....J#....f#.....#.....$....8$....S$.....$.....$.....%.....%....Z%.....%.....%.....%....L&.....&.....'.....'....m'.....'.....'.....(....n(.....(.....).....)....l).....).....).....)....X*.....*.....*.....*....q+.....+....",....;,.....,.....,.....-....6-.....-.....-....).....J............/....F/....V/...../....20....{0.....0.....1....N1....o1.....1.....1....02....X2....j2.....2....F3.....3.....3....04.....4.....5.....5.....5.....5....>6....[6.....6....P7.....7.....7.....8....j8.....8.....8....89.....9.....9

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\ta.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1468553
                                                                                                                                                        Entropy (8bit):4.052663401346278
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3072:eO7hLhGq5MLs32+5CrVKa1i55G62sRtRdutm1vYpiMy+:rdLhGoC+sBD1i554sRtRdutm1vYpiMy+
                                                                                                                                                        MD5:AA06EAD1200F01C9460399F0ABE2D54F
                                                                                                                                                        SHA1:9B852C4691209C0AE9EDF94A5DEC4B902FEC7B3E
                                                                                                                                                        SHA-256:1946D903918C57836D2F898EF93CD1D575DA1A464E358C399DFDE73EA2EF057E
                                                                                                                                                        SHA-512:6E556B962C16AEE22695D93B62B308D95B0695873FB33D13A147B3D8B6791C9599DAA6E3BF424A1897212A018AB36DD8C8214C2EB03457048C6931686BE40E04
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.F...t.]...v.....w.....y.....z.....|.:...}.k.............................................................................).....i...........e...........G.....y.............................}...... .....!.....!....D#....z$.....%....H%....I&....<'.....'.....'.....(.....).....*..../*....g+....k,.....,....V-...........0.....0....21....S2....i3.....4....O4.....5.....6....[7.....7.....8....5:.....;....d;.....<.... >.....?....m?....p@....9A.....A.....A.....B.....C.....D....<D....$E.....E....ZF.....F.....G.....H....UI.....I.....J.....K.....L....<L....*M.....N.....N.....N.....O.....P.....Q....KQ....ER....6S.....S.....S....>U.....V....kW.....W.....X.....Y.....Z....CZ....&[.....[....J\.....\....p]....Y^....$_....q_.....`.....a....+b.....b.....c....Nd.....d.....d.....f...."g.....g.....h.....i.....j....tk.....k.....m.....o.....q....Pq.....r.....s....nt.....t....Nv....tw....$x.....x.....y....vz.....z....6{....h|.....}....5~

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\te.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1359248
                                                                                                                                                        Entropy (8bit):4.307321925100967
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:RG0y8Y7McKNW0yR5D7FgpC8ybtKRT5sbvkW3p/8WffhBp3p1FPnzTitlF2iDk7Pi:RGB+s5RNHFy
                                                                                                                                                        MD5:A4ACCC25DD8A00BC57DF4FCA12E41295
                                                                                                                                                        SHA1:9466888034C9E6ECF4113DDDA63D363ED20E3156
                                                                                                                                                        SHA-256:157D646525F6A9AC267466631671E65E9B5C3E55B008B564186E64C6853E52AA
                                                                                                                                                        SHA-512:F19116655B6C2BB5C572B45F1D712FA1F9D57D9E8963FB3D654ED3781BD34A4E937B590BCC1119A318E28632DA12A0EF8B36F6426791DE833898CF7F30189567
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.:...h.B...i.\...j.h...k.w...l.....n.....o.....p.....q.....r.....s.....t.....v.)...w.U...y.|...z.....|.....}.......+.....0.....8.....@.....H.....O.....V.....].....^....._.....d.......................^.......................D.................".....q............ ..... ....6!....s".....#....+$....f$....H%.....%....D&....y&.....'....X(.....(.....)....'*.....*....l+.....+....O-....y.....E/...../.....0.....1....e2.....2.....3.....4....i5.....5.....7....C8....A9....~9.....:....d<....D=.....=.....>....:?.....?.....?.....@.....A.....B....]B....qC....6D.....D.....D....3F.....G.....G.....H....5I.....J.....J.....J.....K.....L....>M.....M.....N....nO.....O....%P....KQ.....R.....R.....R....8T.....U.....U.....V.....W.....W.....X....`X....+Y.....Y.....Y....,Z.....Z.....[....h\.....\.....].....^....._....#`....$a.....a....4b.....b.....c.....d....#e....pe.....f....sg.....h....Vh....(j.....k.....l....!m.....n.....o....op.....p....6r....#s.....s.....t.....u.....u....?v.....v.....w.....x.....y

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\th.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1142703
                                                                                                                                                        Entropy (8bit):4.350453098899463
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:X6cnN9LyZYAPTKznL/4svUSynUGevuB5Uz0dNL3fRj8NRU+wunRUdGILV+w11LAn:X05ANf
                                                                                                                                                        MD5:B18E4574DB917920ECCFB8E6900D0662
                                                                                                                                                        SHA1:554206B9E639135074B0946FB28B6FFE2D934159
                                                                                                                                                        SHA-256:C14FA1BB30C880216D6CFEA6FB738235CF72A3FE8BE919C3D61321D5A5883211
                                                                                                                                                        SHA-512:5F427F9ED85BB368B45BAFD523C634E18596E430FDC380563878D2CA897CF2580D0405F7C0D8E10ABBA389BB7125978A81D335263BB777E0EE0BFE3D47C8C65F
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........'..e.8...h.@...i.H...j.S...k.b...l.h...o.p...p.}...q.....r.....s.....t.....v.....w.6...y.]...z.....|.....}.........................$.....,.....1.....9.....@.....G.....N.....P.....U.....y.................<.....M.....$.......................`.............................h.......................]...........P............ ....> ..... ....Z!.....!.....!.....".....#.....$.....$....y%.....&.....&.....&.....'....R(.....(.....(.....)....f*.....*.....*.....+....t,.....,.....-....F.....5/...../....30.....1.....1.....1....82.....3.....3.....4....@4.....5.....5.....5.....6.....6.....7.....8....A8.....9.....9....4:....X:....$;.....;....E<....l<.....=.....=.....>..../>.....?.....?....%@....L@....fA....cB....'C....OC.....D.....D.....D.....E.....E....JF.....F.....F....hG.....G....OH.....H.....I....TJ.....J....ZK.....K....oL.....L.....L.....M....<N.....N.....N.....O....KP.....P.....Q.....R.....R.....S.....S.....U.....V.....V....$W.....X.....X....HY....xY.....Z.....Z....![....@[....I\.....].....]

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\tr.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):581275
                                                                                                                                                        Entropy (8bit):5.614415854351588
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:A9dM9N/9/UHzNsgkDQqZFtQSJ8kJ5MLJy:0eZb8kJ50Jy
                                                                                                                                                        MD5:82C6A14BA1B28F947BEE67BC3FEAB091
                                                                                                                                                        SHA1:25023B22EAED29D0817EC95D5BCB4AD3D724F5AD
                                                                                                                                                        SHA-256:099507F6F2A2C98ECCE275F8AD956EEEEAADA65B7788356301AF04A0CD7D431E
                                                                                                                                                        SHA-512:988A9275B7A05D100CA9242DD05969D2363A42938D47DB37A1F62EC1874E96B640C14B272F1829AB5C6E0D2763C22FBF0AF99894D4D9D32726925EABBC02C05E
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.-...v.b...w.....y.....z.....|.....}.;.....d.....i.....q.....y...................................................................................k.................K................. .......................Y.......................].......................D.......................N...................................3.....P............ ....G ....X ..... .....!....6!....F!.....!....2"....u".....".....#.....#.....#.....#....D$.....$.....$.....$....D%.....%.....%.....%....A&.....&.....&.....&....A'.....'.....'.....'....T(.....(.....(.....)....b).....).....).....*...._*.....*.....*.....*....\+.....+.....+.....+.....,.....-....R-....k-.....-....1.....^.....z...........$/....F/....a/...../.....0....C0....U0.....0....,1....f1.....1.....1....52....T2....d2.....2....(3....S3....h3.....3....<4.....4.....4....C5.....5....[6....m6.....6....r7.....7.....7....o8.....8....)9....E9.....9.....:....9:....N:.....:....';....`;

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\uk.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):996487
                                                                                                                                                        Entropy (8bit):4.873979205850633
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:1x/vKIH9mGGHWK9TddsSr+whF5gZrZEdIIXgOb5YB3Ijwl2Ab+rUcauHLNiXErqx:3/vXH9ynh5BrI
                                                                                                                                                        MD5:EC3AA18A9D9C989B1025DDDB0FA52B55
                                                                                                                                                        SHA1:AB3B0834CABEE34BC2F9FD04104B10E5F9C102CA
                                                                                                                                                        SHA-256:EE67744C26E0C69FBED8B102ADD339070AABC70C2D8CA9EA037C6C9D23B66D3B
                                                                                                                                                        SHA-512:90D40424B050C6C7ACE113E85B0B0A58472967C50A14FBC6637CD3B2DB8FF3F521CC94DCD256FA017684256E8A9C19B158AAA57F6D3094FAB970578D3B1C6847
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:........[(..e.t...h.|...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.Z...w.....y.....z.....|.....}.3.....\.....a.....i.....q.....y...........................................................7....."...........x...........\...........b...........W.............................&.................q...........X.....}...... ..... .....!.....!.....!....f".....".....".....#.....$....'%....c%.....&.....&.....'....5'.....'....t(.....(.....(.....)....a*.....*.....*.....+.....,....8-....r-..........k.................\/...../.....0....90.....0....81....v1.....1....H2.....2....F3....m3.....4.....4.....4.....4.....5.....6....R6....k6.....6....z7.....7.....7....n8.....8....<9....W9....P:.... ;.....;.....;....}<.....<....A=....c=.....=....9>....b>.....>....5?.....?....T@....o@....dA.....B.....B.....C.....C.....D....<D....iD.....E.....E.....E.....F.....F....]G.....G.....H.....H.....I....hJ.....J....wK....;L.....L.....M.....M....DN.....N.....N....EO.....O.....P.....P.....P.....Q.....R

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\ur.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):870809
                                                                                                                                                        Entropy (8bit):5.161712117251234
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:wtiyilnG/Uo458PMzCR4FXdQLN9AyTibR45GO6EhTCWORJlbQYrMYVwadcJKwURn:Vyie5T5/Cgu
                                                                                                                                                        MD5:CB228CC41981E8BCBD2768DA20026912
                                                                                                                                                        SHA1:C55BB999C4C1FBEE5E38B6C986FBCE2B128F3880
                                                                                                                                                        SHA-256:A7D825FE348700528800EF9EA7940EE8027373E9C05A4E51E526D0A213C05429
                                                                                                                                                        SHA-512:85308806BE53494683F32520E181DD9C8C9ABAC0B92BC439D4E30EEF22D4AF993794A9719DD9A4EEED0BBCAF61C0E2342E7D4ED5D30B504572BD2BC269100E2E
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(..e.....h.....i.....j.....k.!...l.,...n.4...o.9...p.F...q.L...r.X...s.....t.....v.....w.....y.&...z.T...|.{...}.........................................................................&.....@.....^...........Z.......................w.....!.......................G.......................N.................k...........7.....X...........g ..... ..... ....d!.....!....%"....R".....#.....#.....$....Q$.....$.....%.....%.....&.....&....L'.....'.....'.....(....W).....).....*.....*.....+....7,....h,.....,....H-.....-.....-....+.......................q/...../.....0....90.....0....Z1.....1.....1....a2.....2....A3...._3.....3....j4.....4.....4....U5.....5.....6....)6.....6....47.....7.....7....d8.....9.....9.....9....Q:.....:.....;....=;.....;.....<....K<....y<.....=.....=.....=.....=.....>....@?.....?.....?....x@.....@....%A....HA.....A.....B.....B.....B.....C....GD.....D.....D.....E....xF.....F....!G.....H.....H....-I....lI....7J.....J....4K....bK.....K....qL.....L.....L.....M.....N....oN

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\vi.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):689415
                                                                                                                                                        Entropy (8bit):5.7905904014606335
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:v8/9MO+cGZoEK9VaZLlFK0FgxBxJbTsIxvx5a8h/9cDNUOnmzi0HRva8Z1lc:vSSO+cG6V4lE0uxHZH5a899yiOnwi01k
                                                                                                                                                        MD5:045241A62232BAE57F1D57C6C3AF7C55
                                                                                                                                                        SHA1:5C2A1A677A8BDFA20F3577335131BD4B89A46355
                                                                                                                                                        SHA-256:56758C918BBFE6A9D5B20E8B4A7248BDF2D43E0BF5F98E85A9892FF03DBC2D99
                                                                                                                                                        SHA-512:8E30AF44A53A36A194DA16A756DFF0F90EFBEF164277BDCDE683C89A3CDC04AE5E1298475E8A098D19DAB73EB0A71637F676D49D237C5480E1F7ACA1765166BB
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:........P(..e.^...h.f...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.M...w.y...y.....z.....|.....}.&.....O.....T.....\.....d.....l.....s.....z...........................................................O.................r...........G.....^.......................*...........+.....}.................?.....e.....q...........G.................2.............................. .....!.....!.....!....?"....."....."..../#.....#.....#.....$.....$....;%.....%.....%....t&.....'....q'.....'.....(....o(.....(.....(....').....).....).....)....B*.....*.....*.....*.....+.....+....E,....\,.....,....2-....i-....z-.....-....D.....x.................Q/...../...../.....0....v0.....0.....0....r1.....2....x2.....2.....3.....3.....3.....3....V4.....4.....4...._5.....5.....6....+6.....6....h7.....7.....8.....8.....9....89....Z9.....9....W:.....:.....:....N;.....;.....<....+<.....<....s=.....=.....=.....>....Y?.....?.....?....u@.....@.....A....,A.....A.....A....2B....FB.....B....xC.....C.....C

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\zh-CN.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):496499
                                                                                                                                                        Entropy (8bit):6.685741162993645
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:rr0PPN0s9IHFKwowzwAEM7i56Ez2bHy1t59Lo3/4oT2Paq8lc:XGNXUKwTzwx956Ez2bH05Nov4oTUV
                                                                                                                                                        MD5:798BC7D8B63906C5B1C67E89AD17DC58
                                                                                                                                                        SHA1:B39C86D6D3FD9D8B8DA90D86F827A0C0803FBA8C
                                                                                                                                                        SHA-256:1C05280D8DCDFE99619695B76DD054292A90C1A93A5CFB92CDC4A5B0068A7092
                                                                                                                                                        SHA-512:7A21AF438823D562B889D7C99F639421E01F0536E95F3206DD53D2C8DED82B7A4AB74BB9B4262B2FA27E50EFD8DD7719827AD2E6B6D4C2E0D0811930027ED982
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........(U.e.....h.....i.....j.....k.+...l.2...m.:...o.a...p.f...q.l...r.x...s.....t.....v.....w.....|.F...}.w.........................................................................................%...........6.......................U.......................\.......................e.......................d......................./.....V.....c.................6.....P...........+.....l.....~...........:.....n.....{........... .....I.....U.................;.....M..........." ....` ....r ..... .....!.....!....5!.....!.....!.....!.....!....D"....."....."....."....!#.....#.....#.....#....)$....{$.....$.....$.....%....a%.....%.....%.....%....?&....g&....s&.....&.....'....A'....M'.....'....3(....t(.....(.....(....#)....C)....W).....).....)....$*....;*.....*.....*.....+....(+.....+.....+.....,....),....u,.....,.....,.....,....E-.....-.....-.....-....E.......................a/...../.....0....,0.....0.....0....01....E1.....1.....1.....2....*2....v2.....2.....2.....2....H3.....3.....3.....3....D4

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\locales\zh-TW.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):491017
                                                                                                                                                        Entropy (8bit):6.696102855635661
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:IpP3caOCTyemy5JPFW2uHu4u0JU52UznMi4LnKeze9Tk:qXvmOWzu0JU52UznUeC
                                                                                                                                                        MD5:0BE25A48EECEE48F428FE56FBFA683FD
                                                                                                                                                        SHA1:94C0E8C99BEB592EBAB9EA5B8758AA414BBE7048
                                                                                                                                                        SHA-256:A5E276BDFE4CF87832EEE153596CCDE9CF9193E81F29A4295C8335525DA64295
                                                                                                                                                        SHA-512:423033E67654820AB9F9773F45F70908511AEB8228C59126757885E0BBE0BD960257324D405D27526D61B541B1E6323DE16BEF29D4DCB94F39FD5E92FA811CC8
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.........'..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.&...v.[...w.....y.....z.....|.....}.4.....].....b.....j.....r.....y.....................................................8.......................T.......................@.......................<.......................$.....y.......................J.....k.....x...........(.....N.....h...........%.....T.....i.................J.....W.................(.....4................./.....A.................W.....i.................. ..... ....g ..... ..... ..... ..../!....~!.....!.....!....."....X"....."....."....."....5#....^#....j#.....#.....$....M$....Y$.....$.....$....'%....0%.....%.....%.....&.....&....t&.....&.....'.....'....j'.....'.....'.....'....0(....v(.....(.....(....J)....t).....).....)....3*....d*.....*.....*.....+....!+....-+.....+.....+.....+.....,....s,.....,.....,.....-....|-.....-....=.....L............/....S/....h/...../.....0....G0....S0.....0.....0.....0.....0....M1.....1.....1.....1....=2.....2

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources.pak

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):5755390
                                                                                                                                                        Entropy (8bit):7.996220000544904
                                                                                                                                                        Encrypted:true
                                                                                                                                                        SSDEEP:98304:JZ5ti6+nkrht455GGPeenn0mJSwLEpxIvMi8rwrGU3nAaqdkmYAzFKwR4:j7ilnkrP455GGHnhEXU8kr1Xqdf1FvG
                                                                                                                                                        MD5:6772B597BF68622D934F207570E771B1
                                                                                                                                                        SHA1:F2A80FBFA034CB1FA07DC9AA37BF9F5B2280FF13
                                                                                                                                                        SHA-256:268DE4D99AB7C4F4EE32C8E8CB2B058A2C8D0D839F468AE8E8C0605FEAA736EA
                                                                                                                                                        SHA-512:A2BE67DF09951C9EF9200DCCCBDFF13736921522191F0001DA539D5C7F26B5B26A6B810BE6963908F216768C98D21E52486C7E00538CC0730E8C78E78811B85B
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:............f..#..{.V...|.*1..~..4....OG....aI................V...........@..............................................D9....Dc....D.....D.....D.....D.....D,....D" ...D*$...D.$..HE.$..IE.(..JEx*..SE-/..TE.8..UE.G..VE.h..\E.q..]E.r..^E.s..`E*t..aEty..bE....cExo..dE.Z..eE.[...E.\...E.m...Eho...Exs...E.u...E.{...E.....E....E.....E.....E[....E....EV....E.....E.....E7....E.....E.....E2....E.....L9....L.....L.....L+....LP....L.....L(.../Lo...0L5...1L,)..2L.3...Q.D...Q.P...QdY...Q.\...Q._...Q.j...Q.k...Q.l...QAn...Q.....Q.....R.....R....ZdA&..[d"(..\d:=..]d.@..^dpA.._d3D..`d.G..adqI...d.T...d.Y...d._...d.m...d.p...dUu...d.v...d.x...d.y...d.|...d;....d....6eL...7e|...8e...9e5...:e....;e....<e....=e....>e#...?e....@eo...Ae....Be=...Cex....gp....ga0...g.2.....3.....6.....*....X+.....2.....2.....4.....9.....L....K...........a.....g.....9.....Y.................7... .>...<..L..=..M..>..S..?..X..@.cZ..B.]g..C..i..D..s..E..v..F..w..G.i...H.....I.....J.....K.]...L.....M.....N.S...O._...P.L...Q...

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):11930142
                                                                                                                                                        Entropy (8bit):6.847206908090126
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:98304:yM8gj5wrFTmZ1pQGzpEQTEbFSTc99qkx/vAb2cWd:yq5wrFTmZ1pQGzpEQyYcntIb2cs
                                                                                                                                                        MD5:BF21190C5B7B182913A55B087E3E00EF
                                                                                                                                                        SHA1:F7F1C4C7894E998193EA81EF342491AF2C4A73DF
                                                                                                                                                        SHA-256:F990DCB80D680180E661B1281F5BA19959011E355CB0C5B40801790912D83503
                                                                                                                                                        SHA-512:0805256B05A2CBA20F8C27776E973A6AC0160D28E7BA570CF94852DB9F4B5111CB19BE8272E9BF37E0A7BCA3B9430CD7C39467CECE91B562B6336E7154D8E9B4
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:....P...L...G...{"files":{"node_modules":{"files":{"@babel":{"files":{"generator":{"files":{"LICENSE":{"size":1106,"integrity":{"algorithm":"SHA256","hash":"117da2af0d4ce0fe1c8e19b5cff9dcd806adf973d328d27b11d4448c4ff24f76","blockSize":4194304,"blocks":["117da2af0d4ce0fe1c8e19b5cff9dcd806adf973d328d27b11d4448c4ff24f76"]},"offset":"0"},"lib":{"files":{"buffer.js":{"size":5771,"integrity":{"algorithm":"SHA256","hash":"49d70448373ee7293d57c661383f44e86174059be60d2f8fb98969ae97f16e5e","blockSize":4194304,"blocks":["49d70448373ee7293d57c661383f44e86174059be60d2f8fb98969ae97f16e5e"]},"offset":"1106"},"generators":{"files":{"base.js":{"size":2294,"integrity":{"algorithm":"SHA256","hash":"fb4891bbcaf0f27846b193500bc944213e7cbf2c0feb282795b153d70282e000","blockSize":4194304,"blocks":["fb4891bbcaf0f27846b193500bc944213e7cbf2c0feb282795b153d70282e000"]},"offset":"6877"},"classes.js":{"size":4157,"integrity":{"algorithm":"SHA256","hash":"7f9a3208c888e8ef986bf7cb79a5143fd8bb51308ca17bad9e0a5be0c5251

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\index.js

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:Java source, ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):4000
                                                                                                                                                        Entropy (8bit):5.348928984866719
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:96:umC8wdGAK449W7zAaTkSZPXRS/hLfFBZ8tAemaPe6QaiiFVlPXRYaPJyPXCRy04:93/Gbk4BS5fFL82emJaii/hBLPkXCRyR
                                                                                                                                                        MD5:884E837BDA065828A42D633F81CDFAD5
                                                                                                                                                        SHA1:C1768675091EA6139B90E53853420CCEF9C09A4C
                                                                                                                                                        SHA-256:B7AC5FA0D24DF44755481B9876850FED593423D68C48EED9D30E989879B1864B
                                                                                                                                                        SHA-512:A43BD95B227BA0158A0005A9BFEC6DFDD3AD1CD85BCFBAF37681A7664B4D66E834BDD33484251374F791B5A5D7CBE2DC5CB26BAF0E029712F8977CB5509B9852
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:import process from 'node:process';.import {promisify} from 'node:util';.import path from 'node:path';.import {fileURLToPath} from 'node:url';.import childProcess from 'node:child_process';..const __dirname = path.dirname(fileURLToPath(import.meta.url));..const TEN_MEGABYTES = 1000 * 1000 * 10;.const execFile = promisify(childProcess.execFile);..const windows = async () => {..// Source: https://github.com/MarkTiedemann/fastlist..let binary;..switch (process.arch) {...case 'x64':....binary = 'fastlist-0.3.0-x64.exe';....break;...case 'ia32':....binary = 'fastlist-0.3.0-x86.exe';....break;...default:....throw new Error(`Unsupported architecture: ${process.arch}`);..}...const binaryPath = path.join(__dirname, 'vendor', binary);..const {stdout} = await execFile(binaryPath, {...maxBuffer: TEN_MEGABYTES,...windowsHide: true,..});...return stdout....trim()....split('\r\n')....map(line => line.split('\t'))....map(([pid, ppid, name]) => ({....pid: Number.parseInt(pid, 10),....ppid: Number.parse

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\license

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:ASCII text, with very long lines (460)
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1117
                                                                                                                                                        Entropy (8bit):5.079903213409815
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:FHr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:FH8JplPvEDvQHcs5ITc3omFD
                                                                                                                                                        MD5:D5F2A6DD0192DCC7C833E50BB9017337
                                                                                                                                                        SHA1:80674912E3033BE358331910BA27D5812369C2FC
                                                                                                                                                        SHA-256:5C932D88256B4AB958F64A856FA48E8BD1F55BC1D96B8149C65689E0C61789D3
                                                                                                                                                        SHA-512:D1F336FF272BC6B96DC9A04A7D0EF8F02936DD594F514060340478EE575FE01D55FC7A174DF5814A4FAF72C8462B012998ECA7BB898E3F9A3E87205FB9135AF2
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\package.json

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:JSON data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):606
                                                                                                                                                        Entropy (8bit):4.677493590111802
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12:/r1JPknYwUj+T4SHtGwwnH/h6lGP9pek/GacG1GOcIretJYM+ROA:z1JmUrS0JH/hRrsOreJA
                                                                                                                                                        MD5:0D66A224C9A1C343842B7C97E5634EA6
                                                                                                                                                        SHA1:83E8A14CFACEB5A522E91F057CB76FA98162F9A7
                                                                                                                                                        SHA-256:B7A7AF79AE2225F7DEE5B160559468EFC4663CF8DFD2C6E9A068969CB089B003
                                                                                                                                                        SHA-512:E071F659C7C433B55F0F1AED83AE63032618E522D11077DA83E32D9ED072A20B123CB8083129DF7201DD19BCB1D578D87EF256659B74D9E82A0934B725957F38
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:{. "name": "ps-list",. "version": "8.1.1",. "description": "Get running processes",. "license": "MIT",. "repository": "sindresorhus/ps-list",. "funding": "https://github.com/sponsors/sindresorhus",. "author": {. "name": "Sindre Sorhus",. "email": "sindresorhus@gmail.com",. "url": "https://sindresorhus.com". },. "type": "module",. "exports": "./index.js",. "users": {. "node": "^12.20.0 || ^14.13.1 || >=16.0.0". },. "files": [. "index.js",. "index.d.ts",. "vendor/*.exe". ],. "devDependencies": {. "ava": "^3.15.0",. "tsd": "^0.18.0",. "xo": "^0.46.4". }.}

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):271872
                                                                                                                                                        Entropy (8bit):6.267941112452071
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:JxxmnATc41sT3iVSd87fqCHeohyRDaFsIh:3xmnz41s+VSsfT+o
                                                                                                                                                        MD5:F92F454DE8ECEDD3945DBAEACD381DC3
                                                                                                                                                        SHA1:ED4AA49E15795AC31F1E7CFAEF2E0C16359C5258
                                                                                                                                                        SHA-256:D1A71F9AC1728082C1B276392725C3E010B98714888579B99152E401ABEDBF11
                                                                                                                                                        SHA-512:312D62DA1F41E2B9FE0F15EF30D81A4241F309D83A24643EC8CB99104EF5EF7F52EC216C5CDF0E3995FC5B538DFDFC54E78FBDE3A57EB0AB8BD04DEC07CB5586
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h...,.n.,.n.,.n.w.m.&.n.w.j.>.n.w.k..n...j.<.n...m.&.n...k.}.n.w.o.).n.,.o.L.n..g.-.n....-.n..l.-.n.Rich,.n.........................PE..d......^..........".................D..........@..........................................`.....................................................(....`....... ...#...........p..,.......p..............................0............................................text...\........................... ..`.rdata...I.......J..................@..@.data....*..........................@....pdata...#... ...$..................@..@_RDATA.......P......................@..@.rsrc........`......................@..@.reloc..,....p......................@..B................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exe

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):215040
                                                                                                                                                        Entropy (8bit):6.5588154485327355
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:MuP738wut5T2/efnO310+Hfd+ueCuMvMLAOgp+HQ:MuPL8wut5T2/eCHF+ueCQeQHQ
                                                                                                                                                        MD5:3DE9EE7FE8CF4710DA1C8538A1BD86DF
                                                                                                                                                        SHA1:6FF4B813AD66F0B013222FE044579511A79804D8
                                                                                                                                                        SHA-256:017411F3B0B5C0402CC3B2CB87C32C6FC71ABD82E5B17EA6108990096C75A65D
                                                                                                                                                        SHA-512:0AAB4D484DF289485BEB90EE8B7D929D2D6FA5D7E4385C17B2745DEA40E295F1A9C6C3C8C6C206B46F04A50B51EB01952793FFB84E978C9D0D7447435280ABE7
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HY..)7..)7..)7.A4..)7.A2.Z)7.A3..)7.4F3..)7.4F4..)7.4F2.)7.A6..)7..)6.)7.yY>..)7.yY...)7.yY5..)7.Rich.)7.................PE..L......^.................$.........."z.......@....@.......................................@.................................L$..(....P.......................`... ......p...........................P...@............@..@............................text....".......$.................. ..`.rdata.......@.......(..............@..@.data........0......................@....rsrc........P.......$..............@..@.reloc... ...`..."...&..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\resources\elevate.exe

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):107520
                                                                                                                                                        Entropy (8bit):6.442687067441468
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
                                                                                                                                                        MD5:792B92C8AD13C46F27C7CED0810694DF
                                                                                                                                                        SHA1:D8D449B92DE20A57DF722DF46435BA4553ECC802
                                                                                                                                                        SHA-256:9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
                                                                                                                                                        SHA-512:6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\snapshot_blob.bin

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):316538
                                                                                                                                                        Entropy (8bit):4.177181507694743
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3072:p+JfFRciefJNlUMX2kIE1aOaVsS/3hYeFWYSITdJgClE+ceNTbM:pefPciePmMXh1aOCsy3hpFRlzVw
                                                                                                                                                        MD5:C8950B01F336B05609976546B1A007E6
                                                                                                                                                        SHA1:F04D0B0369007BBE6A7FE129B31B19DD1822F32F
                                                                                                                                                        SHA-256:9B3A75A713E41BC73F219858FCAC8E3031BA22732285ED3A64DC48074C725CC2
                                                                                                                                                        SHA-512:B7DB4277290E849A52AD5D31FF65AB5D2B75C2125D67EEEE02B09E4E7001AA46D10BF89429C65695C7560D1C45B898C20275EB9E36CD8B259707FFB8B298F103
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:..........(.._.13.0.245.16-electron.0..........................................`L..............l....K..}.a........a........a2.......aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\v8_context_snapshot.bin

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):687473
                                                                                                                                                        Entropy (8bit):5.155441647860749
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:vPYRCOn2E6keR1PciePmMXh1aOCsy3hbHRlEDMrVkSiF01gwoHZHCvqmO9iXz8pk:vPY5nnbe3WZBr/iXo73nVE+2l
                                                                                                                                                        MD5:BF2976DA5086B48D74EB36F56F5DEB83
                                                                                                                                                        SHA1:5AA7669A3E2166FDD7534241A0E7A9BD3FF5748B
                                                                                                                                                        SHA-256:9F1614328E18BECB4ADF96DE98BC91CE2A69274ABE6621327CC0FC8503A1AB20
                                                                                                                                                        SHA-512:C44DEEB96597B4498604ECF2060EE0520E84A00308CA1F47FFDF8E3ED3E676B27B622FF7DBD4B6F1A14CE60B05CC2AD9B8D7562BB362C1B12A885EA7FBE50E0A
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:...........a.na.13.0.245.16-electron.0..............................................!...i...1...q.......l...x...}.a........a........a........aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\vk_swiftshader.dll

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):5533184
                                                                                                                                                        Entropy (8bit):6.341413194477468
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:49152:zBVtMrKyOsxYYAKDsJS86IxORjgUlC3K/FAz4gdm6o4oX7uh5LC6MW4LY67h772c:jWKyOEnOnoLrWbfDiN9isC
                                                                                                                                                        MD5:6720D5DCDA6737EB0CC5A352A47414DC
                                                                                                                                                        SHA1:03D9A8E350F485DD955F7DEE06BFC46371753032
                                                                                                                                                        SHA-256:D8F36B089D83157ABC271D9FE125919C3237943FA9789A511AC5EF1D41E2E3AF
                                                                                                                                                        SHA-512:DE5ADE6CE14B14957FCE669C4181AF1E6A6F540798D1C6720B56FF281F813A6CE4446BDE33A8F175D2484E07F4911F93A773CAC1D372CBE3B26BE634B3FA1686
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......B.........P.;.......................................U...........`A..........................................O.......O.P....PU.......S..W...........`U.......O......................O.(.....B.@.............P.8............................text...g.B.......B................. ..`.rdata........B.......B.............@..@.data...H.....P.......P.............@....pdata...W....S..X...VR.............@..@.gxfg...0.....T..0....S.............@..@.retplne..... U.......S..................tls....Y....0U.......S.............@..._RDATA.......@U.......S.............@..@.rsrc........PU.......S.............@..@.reloc.......`U.......S.............@..B........................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\vk_swiftshader_icd.json

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:JSON data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):106
                                                                                                                                                        Entropy (8bit):4.724752649036734
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                        MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                        SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                        SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                        SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\7z-out\vulkan-1.dll

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):894976
                                                                                                                                                        Entropy (8bit):6.60309283089771
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24576:FhJnfYUcguY3cTAL6Z5WjDYsHy6g3P0zAk7TNb:FhVrXN3oAL6Z5WjDYsHy6g3P0zAk7T
                                                                                                                                                        MD5:B6D3AF84E8BE0027741AA6077768789E
                                                                                                                                                        SHA1:E525F2434DC56F79644695F5841E91DD5F80EEC4
                                                                                                                                                        SHA-256:376FF6892EC7B406ACD8C455AC82F8541E59E3757195488FF04CD9F20D554562
                                                                                                                                                        SHA-512:F03B8792A740679C8A1A8CE0615B7876CC811130085F3FFB42182E0CB846519603804DA97FC93A8ABEBEE01E03FD257DF289C54575DA8FAAAD018F4F4BAE606A
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .........................................................@............`A........................................PL..<!...m..P.... .......P..ha...........0..$....:.......................9..(.......@............q...............................text............................... ..`.rdata..............................@..@.data....L......."..................@....pdata..ha...P...b..................@..@.gxfg....%.......&...j..............@..@.retplne.................................tls................................@..._RDATA..............................@..@.rsrc........ ......................@..@.reloc..$....0......................@..B........................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\SpiderBanner.dll

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):9216
                                                                                                                                                        Entropy (8bit):5.5347224014600345
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
                                                                                                                                                        MD5:17309E33B596BA3A5693B4D3E85CF8D7
                                                                                                                                                        SHA1:7D361836CF53DF42021C7F2B148AEC9458818C01
                                                                                                                                                        SHA-256:996A259E53CA18B89EC36D038C40148957C978C0FD600A268497D4C92F882A93
                                                                                                                                                        SHA-512:1ABAC3CE4F2D5E4A635162E16CF9125E059BA1539F70086C2D71CD00D41A6E2A54D468E6F37792E55A822D7082FB388B8DFECC79B59226BBB047B7D28D44D298
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../../../..Wy./../../....../..Wi./..Wx./..W~./..W{./..Rich./..................PE..L...T{mW...........!................p!.......0...............................p............@..........................5..o...l1..P....P.......................`.......................................................0...............................text............................... ..`.rdata.......0......................@..@.data........@......................@....rsrc........P......................@..@.reloc..d....`....... ..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\StdUtils.dll

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):102400
                                                                                                                                                        Entropy (8bit):6.729923587623207
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
                                                                                                                                                        MD5:C6A6E03F77C313B267498515488C5740
                                                                                                                                                        SHA1:3D49FC2784B9450962ED6B82B46E9C3C957D7C15
                                                                                                                                                        SHA-256:B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
                                                                                                                                                        SHA-512:9870C5879F7B72836805088079AD5BBAFCB59FC3D9127F2160D4EC3D6E88D3CC8EBE5A9F5D20A4720FE6407C1336EF10F33B2B9621BC587E930D4CBACF337803
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q....C...C...C...C...C...C...C...C...C...C...C...C...C.[.C...C.[.C...C.[.C...C.[.C...CRich...C........................PE..L...I..[...........!.....*...b...............@.......................................+....@..........................}..d....t..........X............................................................................@...............................text....).......*.................. ..`.rdata..TC...@...D..................@..@.data...l............r..............@....rsrc...X............x..............@..@.reloc..j............~..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\System.dll

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):12288
                                                                                                                                                        Entropy (8bit):5.719859767584478
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
                                                                                                                                                        MD5:0D7AD4F45DC6F5AA87F606D0331C6901
                                                                                                                                                        SHA1:48DF0911F0484CBE2A8CDD5362140B63C41EE457
                                                                                                                                                        SHA-256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
                                                                                                                                                        SHA-512:C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\app-64.7z

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:7-zip archive data, version 0.4
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):86114694
                                                                                                                                                        Entropy (8bit):7.999996367170192
                                                                                                                                                        Encrypted:true
                                                                                                                                                        SSDEEP:1572864:c2/ebAbWkGYFLlAfoabh+XJhXhQiB1dJdYVkq7U9GOWwMMArXPWEWy/S:+0bEYhlAQOh01VJY+qw9dxQXPzl/S
                                                                                                                                                        MD5:2E5FD8EB58C34AE5022D72F5537AA9AE
                                                                                                                                                        SHA1:713C1FD019598B8FA4E3DB84EA24A87F6F7A20FD
                                                                                                                                                        SHA-256:68CC9F4E29797F0F186083711F66C60FA610239B8C46AD30B19FCA43C5FA181A
                                                                                                                                                        SHA-512:D9848EE6A52CF8DE250CFE0BEAE8FD4583A9D69BAEE8C5A9F5E284FAD595452C29A9B59B4F5D90E81212BA9D32F4C8A8E5EDF897CE420D3F0618C2E854A6F1B7
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:7z..'...)m.A.".....%..........,....]...6.....#.0@.1.zL..[...4b ...A....Z7.~...........}.......m.7!*Q..X,s..T...>~(|.s..%...1`.Yw......vK.Tz.|pu.96...D.......w,2PO;I..Z.{..I..y.pn...P..*G.a...Z...(....R..R8|.\....L...k..}..s&.'.....0.."o.s.ZI.=.(.C.?.Gg...|..^....;.e[.w....<.n.@..&Z...$`p ..OzD...V..r.l...ibH..hv."6.m.5.T{*4nh.....Sx.G..1.'.....8.."..................Zk!`.fd..qN.....{.......O.$.|r.{.a|^.]..K*n..t..e.......o.s.v}.....2[M..1..yG..]Y. ...Z=....?.\#*..)...!k...X....G.%>......t..7.}.G.~HV..D.[.....4....!.....=.r.../P.5*..j1^.!..W).!...J.!H0....Rj..[..0.y.u...5..bC...\..{...Cv...`xN|....2m.A.{..m..y).*B.q.D.y...j.\.R#.CX\n..L>.NN.]..cj{>..p.j}.&..Z<.`7....o.......k..z.. ...?..~g.|m....kysn.q.., b>'.:,p...... .......V..x........0j.......F..3....W.......xO.....w.q..a....s.4#.GWP.........r'...K....+_^"0T=.+.....u)......xEP.Il.}.P>.@{.9{.......*...Q..E..[..[34..wx....Z...$..U.....vg....k.......Z.$j....#.b.rF....#5...XO.u...saZ...'.

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\nsExec.dll

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):6656
                                                                                                                                                        Entropy (8bit):5.155286976455086
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
                                                                                                                                                        MD5:EC0504E6B8A11D5AAD43B296BEEB84B2
                                                                                                                                                        SHA1:91B5CE085130C8C7194D66B2439EC9E1C206497C
                                                                                                                                                        SHA-256:5D9CEB1CE5F35AEA5F9E5A0C0EDEEEC04DFEFE0C77890C80C70E98209B58B962
                                                                                                                                                        SHA-512:3F918F1B47E8A919CBE51EB17DC30ACC8CFC18E743A1BAE5B787D0DB7D26038DC1210BE98BF5BA3BE8D6ED896DBBD7AC3D13E66454A98B2A38C7E69DAD30BB57
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....~.\...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsw1DF5.tmp\nsis7z.dll

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):434176
                                                                                                                                                        Entropy (8bit):6.584811966667578
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
                                                                                                                                                        MD5:80E44CE4895304C6A3A831310FBF8CD0
                                                                                                                                                        SHA1:36BD49AE21C460BE5753A904B4501F1ABCA53508
                                                                                                                                                        SHA-256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
                                                                                                                                                        SHA-512:C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Nov 15 06:17:30 2024, mtime=Fri Nov 15 06:17:40 2024, atime=Thu Nov 14 09:15:50 2024, length=188703744, window=hide
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1155
                                                                                                                                                        Entropy (8bit):4.892074241440446
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:8GHyCDblXkAXURYJz+ChKYq8AHadG137ptzOXmqygm:8crDblUAERYJ+2q76dG13NtOyg
                                                                                                                                                        MD5:1FC0561D33BC7928E004E75B338E9F23
                                                                                                                                                        SHA1:6FD0AA8662AAEB87DFAF332B35FB57F1E051FAE0
                                                                                                                                                        SHA-256:6E7532270F6D7EA90E37E3706762914C516400B885154A69854630D60030F504
                                                                                                                                                        SHA-512:009FB866001E7C199CEF766EAA57973641D79066E8FEFDBE4B9CE0750E32894D69C77EA710D11616C319401151B1F804DAF4AC8F35A70E3FC4E780C75493B10B
                                                                                                                                                        Malicious:true
                                                                                                                                                        Preview:L..................F.... ......o.7..d.t.7.....-~6...d?.......................:..DG..Yr?.D..U..k0.&...&.......$..S.....].7..&Y[v.7......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2oY#:...........................^.A.p.p.D.a.t.a...B.P.1.....oY3:..Local.<......EW<2oY3:....[.....................s...L.o.c.a.l.....Z.1.....oY&:..Programs..B......oY%:oY&:....!......................y{.P.r.o.g.r.a.m.s.....N.1.....oY3:..Slax..:......oY&:oY3:..............................S.l.a.x.....Z.2..d?.nY.Q .Slax.exe..B......oY0:oY0:..............................S.l.a.x...e.x.e.......e...............-.......d.............}c.....C:\Users\user\AppData\Local\Programs\Slax\Slax.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.S.l.a.x.\.S.l.a.x...e.x.e.............:...........|....I.J.H..K..:...`.......X.......506013...........hT..CrF.f4... .$..Jc...-...-$..hT..CrF.f4... .$..Jc...-...-$.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.

                                                                                                                                                        C:\Users\user\AppData\Roaming\Slax\Local State (copy)

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                        File Type:JSON data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):434
                                                                                                                                                        Entropy (8bit):5.638492987696439
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:YKWCRGBmEuZpn9RdrtybHV2LirlWDm8S2FqJqZzyV8cB1nLyQLOKB6IVguGn/dkw:YKWSCuj9rrt+12LikvQZVd9WWCuGnx
                                                                                                                                                        MD5:2A1CB2E3FCE0F9AB777299D91325FE5F
                                                                                                                                                        SHA1:56F9AC820EDE3FB26894CD27C05094A43B4849E6
                                                                                                                                                        SHA-256:A4430B559193FA02F1312944F3BE097D24BA0228980E980C65B93CC3D0A795C4
                                                                                                                                                        SHA-512:28B2C67F10D86E707D42EFADEF8B1E8960A37CC6704BE88C34A151DF66B0075F0D56644837F6FCDCFC69ECAB51D56B9F8DC1AB2C7F292CFEBF1FEF95C2C2121D
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABNhS1krsj7TZXnVQrdQ4vzEAAAABIAAABDAGgAcgBvAG0AaQB1AG0AAAAQZgAAAAEAACAAAACLzk6sM4CUktsjfucrTpr0SUy9MImHLzT0Om/3lPjo5AAAAAAOgAAAAAIAACAAAAAa2O1NMz1C0HeedR0ioA1pi/S74y9X9W+3qyGok2XSijAAAABIURFYWlJ5ATtZeQjX2i61z3zTbpthIaih3CpIdzX2wKQwbpnqTf6sc3d6x3LmArRAAAAAVIthsWzC4SzMcL3MS8y82MBfyfaXZy7cAROyafXADZDdAveKmQmgZAuwPP5MT8npcw+0tzlWxfF13HbZ9IUBrg=="}}

                                                                                                                                                        C:\Users\user\AppData\Roaming\Slax\config.json

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                        File Type:JSON data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):73
                                                                                                                                                        Entropy (8bit):4.53489305270913
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:NBH1O6tT8Idx6PNu1zFHK8BHEKY:L1OAoIdekFq8BHEKY
                                                                                                                                                        MD5:2930D6515CC4C87FC9288AEF23819FF0
                                                                                                                                                        SHA1:0CB6E2AAA62A23439DB823F57E1B17E9B749CCA4
                                                                                                                                                        SHA-256:881376ED7AD5BFC1C41D099E6D10366E52A77AD5EAF762D1956BBFB1FA45FB45
                                                                                                                                                        SHA-512:E48017CFF40F8EAB22D2FC10573EE9F61A48D2D23B10657E33C8C592919DB65851EB291E9E23589EB90E727C458BE81BACBEA4995AEF5390DA7531A95C738ED1
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:{. "uuid": "babddbde-7da6-46b9-8c54-b6f11dab33a9",. "installed": true.}

                                                                                                                                                        C:\Users\user\AppData\Roaming\Slax\f61ca661-52a5-49a9-9a85-82595ea08e05.tmp

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                        File Type:JSON data
                                                                                                                                                        Category:modified
                                                                                                                                                        Size (bytes):434
                                                                                                                                                        Entropy (8bit):5.638492987696439
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:YKWCRGBmEuZpn9RdrtybHV2LirlWDm8S2FqJqZzyV8cB1nLyQLOKB6IVguGn/dkw:YKWSCuj9rrt+12LikvQZVd9WWCuGnx
                                                                                                                                                        MD5:2A1CB2E3FCE0F9AB777299D91325FE5F
                                                                                                                                                        SHA1:56F9AC820EDE3FB26894CD27C05094A43B4849E6
                                                                                                                                                        SHA-256:A4430B559193FA02F1312944F3BE097D24BA0228980E980C65B93CC3D0A795C4
                                                                                                                                                        SHA-512:28B2C67F10D86E707D42EFADEF8B1E8960A37CC6704BE88C34A151DF66B0075F0D56644837F6FCDCFC69ECAB51D56B9F8DC1AB2C7F292CFEBF1FEF95C2C2121D
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABNhS1krsj7TZXnVQrdQ4vzEAAAABIAAABDAGgAcgBvAG0AaQB1AG0AAAAQZgAAAAEAACAAAACLzk6sM4CUktsjfucrTpr0SUy9MImHLzT0Om/3lPjo5AAAAAAOgAAAAAIAACAAAAAa2O1NMz1C0HeedR0ioA1pi/S74y9X9W+3qyGok2XSijAAAABIURFYWlJ5ATtZeQjX2i61z3zTbpthIaih3CpIdzX2wKQwbpnqTf6sc3d6x3LmArRAAAAAVIthsWzC4SzMcL3MS8y82MBfyfaXZy7cAROyafXADZDdAveKmQmgZAuwPP5MT8npcw+0tzlWxfF13HbZ9IUBrg=="}}

                                                                                                                                                        \Device\Null

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                        File Type:ASCII text, with very long lines (427)
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):900
                                                                                                                                                        Entropy (8bit):4.906527703022025
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:G8UKQdaBz+saQD7CysJE/xmQoNcckXoex:wKQwBz+QD7UEJmQTH
                                                                                                                                                        MD5:C23EC5970DE9166FB4CB383F3D300536
                                                                                                                                                        SHA1:86D74877B9D667611F5FC452C6DEDC22508AE7BE
                                                                                                                                                        SHA-256:78C9CEAB19EEA9B7DD05EFD883D3DA84AD4D83FB9E5A64E8F95AE6FFE761EA94
                                                                                                                                                        SHA-512:1B71592F251E9FA805EED67F3B27C8FFE2233C25A26E9E283A53EC9F39626A23B6DC7E41691CB19199F8FC80138D7BAEFFA2E6D59C474A4DF67770CC165BE264
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:(node:1444) UnhandledPromiseRejectionWarning: TypeError: Cannot read properties of undefined (reading 'model'). at getSystemInfo (C:\Users\user\AppData\Local\Programs\Slax\resources\app.asar\main.js:50:31). at App.<anonymous> (C:\Users\user\AppData\Local\Programs\Slax\resources\app.asar\main.js:329:24). at process.processTicksAndRejections (node:internal/process/task_queues:95:5).(Use `Slax --trace-warnings ...` to show where the warning was created).(node:1444) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag `--unhandled-rejections=strict` (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 1).

                                                                                                                                                        Static File Info

                                                                                                                                                        General

                                                                                                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                        Entropy (8bit):7.999988336585389
                                                                                                                                                        TrID:
                                                                                                                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                        File name:G4fDWS1Fpd.exe
                                                                                                                                                        File size:86'638'456 bytes
                                                                                                                                                        MD5:2e0143d084a2217b24f58d597169cb16
                                                                                                                                                        SHA1:599870ccdec203f715cdd37ebf402df36400c1e4
                                                                                                                                                        SHA256:fac7f1a54eef98830ecbd25fef364695b8afd9e255dcc19702dac84ee526c5ca
                                                                                                                                                        SHA512:8033642d91aa3def6782e028d4e797ef2e260e5f85064b8d8f32b8e3138bdecb27bd3275fd3ca2166d1a41721a2311dee098064bd832ea0ef73cf59fc5d7cbc4
                                                                                                                                                        SSDEEP:1572864:IA2/ebAbWkGYFLlAfoabh+XJhXhQiB1dJdYVkq7U9GOWwMMArXPWEWy/t:IK0bEYhlAQOh01VJY+qw9dxQXPzl/t
                                                                                                                                                        TLSH:F418332C0944C2B3C21854BDF7E7C7E74551B7138A0D2FAE223AB17CD35B2E725A95A2
                                                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

                                                                                                                                                        File Icon

                                                                                                                                                        Icon Hash:b846616869b8cc70

                                                                                                                                                        Static PE Info

                                                                                                                                                        General

                                                                                                                                                        Entrypoint:0x40338f
                                                                                                                                                        Entrypoint Section:.text
                                                                                                                                                        Digitally signed:true
                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                        Subsystem:windows gui
                                                                                                                                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                        Time Stamp:0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
                                                                                                                                                        TLS Callbacks:
                                                                                                                                                        CLR (.Net) Version:
                                                                                                                                                        OS Version Major:4
                                                                                                                                                        OS Version Minor:0
                                                                                                                                                        File Version Major:4
                                                                                                                                                        File Version Minor:0
                                                                                                                                                        Subsystem Version Major:4
                                                                                                                                                        Subsystem Version Minor:0
                                                                                                                                                        Import Hash:b34f154ec913d2d2c435cbd644e91687

                                                                                                                                                        Authenticode Signature

                                                                                                                                                        Signature Valid:false
                                                                                                                                                        Signature Issuer:CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
                                                                                                                                                        Signature Validation Error:A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file
                                                                                                                                                        Error Number:-2146762495
                                                                                                                                                        Not Before, Not After
                                                                                                                                                        • 15/10/2024 20:29:09 16/10/2025 20:29:09
                                                                                                                                                        Subject Chain
                                                                                                                                                        • CN="Lion Software, LLC", O="Lion Software, LLC", STREET=60 County Road 537, L=Centre, S=Alabama, C=US, OID.1.3.6.1.4.1.311.60.2.1.2=Alabama, OID.1.3.6.1.4.1.311.60.2.1.3=US, SERIALNUMBER=000-541-240, OID.2.5.4.15=Private Organization
                                                                                                                                                        Version:3
                                                                                                                                                        Thumbprint MD5:AC575FB5F87D72747656ED9FFBAEB0DA
                                                                                                                                                        Thumbprint SHA-1:A243692CD9205CFE32BEEF144B7D84350F3AA0E6
                                                                                                                                                        Thumbprint SHA-256:482DFF658DB3FF3B08ED60A99B5434DE6E8CF3F1DCB782831AA0B22978F7C49D
                                                                                                                                                        Serial:1AF0A44396DD57AC87ECB79D

                                                                                                                                                        Entrypoint Preview

                                                                                                                                                        Instruction
                                                                                                                                                        sub esp, 000002D4h
                                                                                                                                                        push ebx
                                                                                                                                                        push esi
                                                                                                                                                        push edi
                                                                                                                                                        push 00000020h
                                                                                                                                                        pop edi
                                                                                                                                                        xor ebx, ebx
                                                                                                                                                        push 00008001h
                                                                                                                                                        mov dword ptr [esp+14h], ebx
                                                                                                                                                        mov dword ptr [esp+10h], 0040A2E0h
                                                                                                                                                        mov dword ptr [esp+1Ch], ebx
                                                                                                                                                        call dword ptr [004080A8h]
                                                                                                                                                        call dword ptr [004080A4h]
                                                                                                                                                        and eax, BFFFFFFFh
                                                                                                                                                        cmp ax, 00000006h
                                                                                                                                                        mov dword ptr [0047AEECh], eax
                                                                                                                                                        je 00007FA089246F23h
                                                                                                                                                        push ebx
                                                                                                                                                        call 00007FA08924A1D5h
                                                                                                                                                        cmp eax, ebx
                                                                                                                                                        je 00007FA089246F19h
                                                                                                                                                        push 00000C00h
                                                                                                                                                        call eax
                                                                                                                                                        mov esi, 004082B0h
                                                                                                                                                        push esi
                                                                                                                                                        call 00007FA08924A14Fh
                                                                                                                                                        push esi
                                                                                                                                                        call dword ptr [00408150h]
                                                                                                                                                        lea esi, dword ptr [esi+eax+01h]
                                                                                                                                                        cmp byte ptr [esi], 00000000h
                                                                                                                                                        jne 00007FA089246EFCh
                                                                                                                                                        push 0000000Ah
                                                                                                                                                        call 00007FA08924A1A8h
                                                                                                                                                        push 00000008h
                                                                                                                                                        call 00007FA08924A1A1h
                                                                                                                                                        push 00000006h
                                                                                                                                                        mov dword ptr [0047AEE4h], eax
                                                                                                                                                        call 00007FA08924A195h
                                                                                                                                                        cmp eax, ebx
                                                                                                                                                        je 00007FA089246F21h
                                                                                                                                                        push 0000001Eh
                                                                                                                                                        call eax
                                                                                                                                                        test eax, eax
                                                                                                                                                        je 00007FA089246F19h
                                                                                                                                                        or byte ptr [0047AEEFh], 00000040h
                                                                                                                                                        push ebp
                                                                                                                                                        call dword ptr [00408044h]
                                                                                                                                                        push ebx
                                                                                                                                                        call dword ptr [004082A0h]
                                                                                                                                                        mov dword ptr [0047AFB8h], eax
                                                                                                                                                        push ebx
                                                                                                                                                        lea eax, dword ptr [esp+34h]
                                                                                                                                                        push 000002B4h
                                                                                                                                                        push eax
                                                                                                                                                        push ebx
                                                                                                                                                        push 00440208h
                                                                                                                                                        call dword ptr [00408188h]
                                                                                                                                                        push 0040A2C8h

                                                                                                                                                        Rich Headers

                                                                                                                                                        Programming Language:
                                                                                                                                                        • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                                        Data Directories

                                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x19f0000x7288.rsrc
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x529ed500x1228
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                        Sections

                                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                        .text0x10000x66270x68007618d4c0cd8bb67ea9595b4266b3a91fFalse0.6646259014423077data6.450282348506287IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                        .rdata0x80000x14a20x1600eecac1fed9cc6b447d50940d178404d8False0.4405184659090909data5.025178929113415IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                        .data0xa0000x70ff80x600db8f31a08a2242d80c29e1f9500c6527False0.5182291666666666data4.037117731448378IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                        .ndata0x7b0000x1240000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                        .rsrc0x19f0000x72880x7400f69ada40a97c7fc099a1460d31656fb9False0.7685546875data7.154628246749218IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                        Resources

                                                                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                        RT_ICON0x19f4a80x50d5PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States1.0007732083313197
                                                                                                                                                        RT_DIALOG0x1a45800x202dataEnglishUnited States0.4085603112840467
                                                                                                                                                        RT_DIALOG0x1a47880xf8dataEnglishUnited States0.6290322580645161
                                                                                                                                                        RT_DIALOG0x1a48800xeedataEnglishUnited States0.6260504201680672
                                                                                                                                                        RT_DIALOG0x1a49700x1fadataEnglishUnited States0.40118577075098816
                                                                                                                                                        RT_DIALOG0x1a4b700xf0dataEnglishUnited States0.6666666666666666
                                                                                                                                                        RT_DIALOG0x1a4c600xe6dataEnglishUnited States0.6565217391304348
                                                                                                                                                        RT_DIALOG0x1a4d480x1eedataEnglishUnited States0.38866396761133604
                                                                                                                                                        RT_DIALOG0x1a4f380xe4dataEnglishUnited States0.6447368421052632
                                                                                                                                                        RT_DIALOG0x1a50200xdadataEnglishUnited States0.6422018348623854
                                                                                                                                                        RT_DIALOG0x1a51000x1eedataEnglishUnited States0.3866396761133603
                                                                                                                                                        RT_DIALOG0x1a52f00xe4dataEnglishUnited States0.6359649122807017
                                                                                                                                                        RT_DIALOG0x1a53d80xdadataEnglishUnited States0.6376146788990825
                                                                                                                                                        RT_DIALOG0x1a54b80x1f2dataEnglishUnited States0.39759036144578314
                                                                                                                                                        RT_DIALOG0x1a56b00xe8dataEnglishUnited States0.6508620689655172
                                                                                                                                                        RT_DIALOG0x1a57980xdedataEnglishUnited States0.6486486486486487
                                                                                                                                                        RT_DIALOG0x1a58780x202dataEnglishUnited States0.42217898832684825
                                                                                                                                                        RT_DIALOG0x1a5a800xf8dataEnglishUnited States0.6653225806451613
                                                                                                                                                        RT_DIALOG0x1a5b780xeedataEnglishUnited States0.6512605042016807
                                                                                                                                                        RT_GROUP_ICON0x1a5c680x14dataEnglishUnited States1.05
                                                                                                                                                        RT_VERSION0x1a5c800x1e0dataEnglishUnited States0.51875
                                                                                                                                                        RT_MANIFEST0x1a5e600x423XML 1.0 document, ASCII text, with very long lines (1059), with no line terminatorsEnglishUnited States0.5127478753541076

                                                                                                                                                        Imports

                                                                                                                                                        DLLImport
                                                                                                                                                        KERNEL32.dllSetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
                                                                                                                                                        USER32.dllGetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
                                                                                                                                                        GDI32.dllSelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                                                                                                                        SHELL32.dllSHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
                                                                                                                                                        ADVAPI32.dllAdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
                                                                                                                                                        COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                                                                                                                        ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                                                                                                                        Possible Origin

                                                                                                                                                        Language of compilation systemCountry where language is spokenMap
                                                                                                                                                        EnglishUnited States

                                                                                                                                                        Network Behavior

                                                                                                                                                        ⊘No network behavior found

                                                                                                                                                        Statistics

                                                                                                                                                        CPU Usage

                                                                                                                                                        Click to jump to process

                                                                                                                                                        Memory Usage

                                                                                                                                                        Click to jump to process

                                                                                                                                                        High Level Behavior Distribution

                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                        Behavior

                                                                                                                                                        Click to jump to process

                                                                                                                                                        System Behavior

                                                                                                                                                        General

                                                                                                                                                        Target ID:0
                                                                                                                                                        Start time:02:17:09
                                                                                                                                                        Start date:15/11/2024
                                                                                                                                                        Path:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:"C:\Users\user\Desktop\G4fDWS1Fpd.exe"
                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                        File size:86'638'456 bytes
                                                                                                                                                        MD5 hash:2E0143D084A2217B24F58D597169CB16
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:low
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:2
                                                                                                                                                        Start time:02:17:10
                                                                                                                                                        Start date:15/11/2024
                                                                                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Slax.exe" /FO csv | "C:\Windows\system32\find.exe" "Slax.exe"
                                                                                                                                                        Imagebase:0x1c0000
                                                                                                                                                        File size:236'544 bytes
                                                                                                                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:3
                                                                                                                                                        Start time:02:17:10
                                                                                                                                                        Start date:15/11/2024
                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:4
                                                                                                                                                        Start time:02:17:10
                                                                                                                                                        Start date:15/11/2024
                                                                                                                                                        Path:C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Slax.exe" /FO csv
                                                                                                                                                        Imagebase:0x970000
                                                                                                                                                        File size:79'360 bytes
                                                                                                                                                        MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:5
                                                                                                                                                        Start time:02:17:10
                                                                                                                                                        Start date:15/11/2024
                                                                                                                                                        Path:C:\Windows\SysWOW64\find.exe
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:"C:\Windows\system32\find.exe" "Slax.exe"
                                                                                                                                                        Imagebase:0x6f0000
                                                                                                                                                        File size:14'848 bytes
                                                                                                                                                        MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:moderate
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:7
                                                                                                                                                        Start time:02:17:37
                                                                                                                                                        Start date:15/11/2024
                                                                                                                                                        Path:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Programs\Slax\Slax.exe"
                                                                                                                                                        Imagebase:0x7ff6dd520000
                                                                                                                                                        File size:188'703'744 bytes
                                                                                                                                                        MD5 hash:262797985453830673179336B6BACAC6
                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Antivirus matches:
                                                                                                                                                        • Detection: 0%, ReversingLabs
                                                                                                                                                        Reputation:low
                                                                                                                                                        Has exited:false

                                                                                                                                                        General

                                                                                                                                                        Target ID:10
                                                                                                                                                        Start time:02:17:41
                                                                                                                                                        Start date:15/11/2024
                                                                                                                                                        Path:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1816,i,11646247368897797242,13434058048070250299,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
                                                                                                                                                        Imagebase:0x7ff6dd520000
                                                                                                                                                        File size:188'703'744 bytes
                                                                                                                                                        MD5 hash:262797985453830673179336B6BACAC6
                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:low
                                                                                                                                                        Has exited:false

                                                                                                                                                        General

                                                                                                                                                        Target ID:11
                                                                                                                                                        Start time:02:17:40
                                                                                                                                                        Start date:15/11/2024
                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()""
                                                                                                                                                        Imagebase:0x7ff63be20000
                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:12
                                                                                                                                                        Start time:02:17:40
                                                                                                                                                        Start date:15/11/2024
                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:13
                                                                                                                                                        Start time:02:17:40
                                                                                                                                                        Start date:15/11/2024
                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"
                                                                                                                                                        Imagebase:0x7ff6e3d50000
                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:15
                                                                                                                                                        Start time:02:17:44
                                                                                                                                                        Start date:15/11/2024
                                                                                                                                                        Path:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2584,i,11646247368897797242,13434058048070250299,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:3
                                                                                                                                                        Imagebase:0x7ff6dd520000
                                                                                                                                                        File size:188'703'744 bytes
                                                                                                                                                        MD5 hash:262797985453830673179336B6BACAC6
                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:low
                                                                                                                                                        Has exited:false

                                                                                                                                                        General

                                                                                                                                                        Target ID:18
                                                                                                                                                        Start time:02:17:56
                                                                                                                                                        Start date:15/11/2024
                                                                                                                                                        Path:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Programs\Slax\Slax.exe"
                                                                                                                                                        Imagebase:0x7ff6dd520000
                                                                                                                                                        File size:188'703'744 bytes
                                                                                                                                                        MD5 hash:262797985453830673179336B6BACAC6
                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:low
                                                                                                                                                        Has exited:false

                                                                                                                                                        General

                                                                                                                                                        Target ID:19
                                                                                                                                                        Start time:02:17:56
                                                                                                                                                        Start date:15/11/2024
                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()""
                                                                                                                                                        Imagebase:0x7ff63be20000
                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:20
                                                                                                                                                        Start time:02:17:58
                                                                                                                                                        Start date:15/11/2024
                                                                                                                                                        Path:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1864,i,400091264659153544,17151257105363730347,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2
                                                                                                                                                        Imagebase:0x7ff6dd520000
                                                                                                                                                        File size:188'703'744 bytes
                                                                                                                                                        MD5 hash:262797985453830673179336B6BACAC6
                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:low
                                                                                                                                                        Has exited:false

                                                                                                                                                        General

                                                                                                                                                        Target ID:21
                                                                                                                                                        Start time:02:17:56
                                                                                                                                                        Start date:15/11/2024
                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:22
                                                                                                                                                        Start time:02:17:56
                                                                                                                                                        Start date:15/11/2024
                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"
                                                                                                                                                        Imagebase:0x7ff6e3d50000
                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:23
                                                                                                                                                        Start time:02:17:59
                                                                                                                                                        Start date:15/11/2024
                                                                                                                                                        Path:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2392,i,400091264659153544,17151257105363730347,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
                                                                                                                                                        Imagebase:0x7ff6dd520000
                                                                                                                                                        File size:188'703'744 bytes
                                                                                                                                                        MD5 hash:262797985453830673179336B6BACAC6
                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Has exited:false

                                                                                                                                                        Disassembly

                                                                                                                                                        ⊘No disassembly