Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
G4fDWS1Fpd.exe

Overview

General Information

Sample name:G4fDWS1Fpd.exe
renamed because original name is a hash value
Original sample name:fac7f1a54eef98830ecbd25fef364695b8afd9e255dcc19702dac84ee526c5ca.exe
Analysis ID:1556260
MD5:2e0143d084a2217b24f58d597169cb16
SHA1:599870ccdec203f715cdd37ebf402df36400c1e4
SHA256:fac7f1a54eef98830ecbd25fef364695b8afd9e255dcc19702dac84ee526c5ca
Tags:exeLionSoftwareLLCuser-JAMESWT_MHT
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Sigma detected: Powershell create lnk in startup
Drops large PE files
Powershell creates an autostart link
Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Drops PE files
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • G4fDWS1Fpd.exe (PID: 6288 cmdline: "C:\Users\user\Desktop\G4fDWS1Fpd.exe" MD5: 2E0143D084A2217B24F58D597169CB16)
    • cmd.exe (PID: 6504 cmdline: "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Slax.exe" /FO csv | "C:\Windows\system32\find.exe" "Slax.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 6524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • tasklist.exe (PID: 6644 cmdline: tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Slax.exe" /FO csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
      • find.exe (PID: 6664 cmdline: "C:\Windows\system32\find.exe" "Slax.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
  • Slax.exe (PID: 7028 cmdline: "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" MD5: 262797985453830673179336B6BACAC6)
    • Slax.exe (PID: 6904 cmdline: "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1760,i,7052398392554665292,13112330197020623340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2 MD5: 262797985453830673179336B6BACAC6)
    • cmd.exe (PID: 5100 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 1144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 796 cmdline: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • Slax.exe (PID: 2336 cmdline: "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2528,i,7052398392554665292,13112330197020623340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3 MD5: 262797985453830673179336B6BACAC6)
    • Slax.exe (PID: 6792 cmdline: "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1224,i,7052398392554665292,13112330197020623340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8 MD5: 262797985453830673179336B6BACAC6)
  • Slax.exe (PID: 6884 cmdline: "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" MD5: 262797985453830673179336B6BACAC6)
    • Slax.exe (PID: 6984 cmdline: "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1740,i,15859010876315112086,12757602484505537374,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2 MD5: 262797985453830673179336B6BACAC6)
    • cmd.exe (PID: 6356 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 4428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 4476 cmdline: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • Slax.exe (PID: 5344 cmdline: "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2400,i,15859010876315112086,12757602484505537374,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3 MD5: 262797985453830673179336B6BACAC6)
    • Slax.exe (PID: 4428 cmdline: "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2504,i,15859010876315112086,12757602484505537374,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8 MD5: 262797985453830673179336B6BACAC6)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
Source: File createdAuthor: Christopher Peacock '@securepeacock', SCYTHE: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 796, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk
Sigma detected: Startup Folder File Write
Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 796, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()", CommandLine: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5100, ParentProcessName: cmd.exe, ProcessCommandLine: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()", ProcessId: 796, ProcessName: powershell.exe

Persistence and Installation Behavior

barindex
Sigma detected: Powershell create lnk in startup
Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"", CommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" , ParentImage: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe, ParentProcessId: 7028, ParentProcessName: Slax.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"", ProcessId: 5100, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: G4fDWS1Fpd.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\c0a9b0da-fe7b-568f-ba03-753b28d39f41Jump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Programs\Slax\LICENSE.electron.txtJump to behavior
Source: G4fDWS1Fpd.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: vulkan-1.dll.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.2072490673.0000000005A90000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2078215891.0000000006610000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2072043165.00000000030C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vk_swiftshader.dll.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resourcesJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendorJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpackedJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpacked\node_modulesJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-listJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\localesJump to behavior
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: * **Google Hangouts Video**: http://www.youtube.com/watch?v=I9nDOSGfwZg equals www.youtube.com (Youtube)
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://2x.io)
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096464
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096601
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096643
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644663
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644740
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644747
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644776
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261226
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261756
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261881
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261882
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262115
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262161
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262166
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262239
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262247
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262249
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262258
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262286
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262287
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262476
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262955
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263010
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263031
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263049
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263158
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263239
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263622
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263911
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263960
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263969
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264577
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264767
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264951
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265353
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265841
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265957
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266019
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266725
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267057
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://blog.izs.me/)
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cldr.unicode.org/index/downloads
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/closure-compiler/wiki/SourceMaps
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/python-gflags/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/smhasher/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://feross.org
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://fresc81.github.io/node-winreg
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://git.linuxtv.org/v4l-utils.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/troygoode/)
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://google.github.io/snappy/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://issuetracker.google.com/200067929
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://n8.io/)
Source: G4fDWS1Fpd.exe, 00000000.00000000.1850534177.000000000040A000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://opensource.perlig.de/rjsmin/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://source.android.com/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://source.android.com/compatibility)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/a/1068308/13216
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://substack.net
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://travis-ci.org/troygoode/node-require-directory)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://userguide.icu-project.org/strings/properties
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/legal/guidelinesfor3rdparties.html.
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ecma-international.org/memento/codeofconduct.htm
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.finesse.demon.co.uk/steven/sqrt.html.
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.freedesktop.org/wiki/Software/xdg-user-dirs
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.futurealoof.com)
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.gutenberg.org/ebooks/53).
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.linux-usb.org/usb-ids.html
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.midnight-commander.org/browser/lib/tty/key.c
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/MPL/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.apple.com/apsl/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/bsd-license.php
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.pertinentdetail.org/sqrt
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ploscompbiol.org/static/license
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.polymer-project.org
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.portaudio.com
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.softsynth.com
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.unicode.org/copyright.html
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.webrtc.org
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/watch?v=I9nDOSGfwZg
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://zlib.net/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://%s:%d/.well-known/masque/udp/%s/%d/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://%s:%d/.well-known/masque/udp/%s/%d/Net.QuicStreamFactory.DefaultNetworkMatchNet.QuicSession.
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://android.googlesource.com/platform/external/puffin
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/40644850
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265782
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/external/github.com/intel/tinycbor.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/vulkan-deps/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/webm/libwebm
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/webm/libwebp
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://code.google.com/p/v8/wiki/JavaScriptStackTraceApi
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#clear
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#console-namespace
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#count
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#count-map
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#countreset
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#table
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/v8/7848
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://creativecommons.org/licenses/by/3.0/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cs.chromium.org/chromium/src/v8/tools/SourceMap.js?rcl=dd10454c1d
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7231#section-6.4
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7238
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/PerformanceResourceTiming
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Equality_comparisons_and_sameness#Loose_equa
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/includes
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/startsWith
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/android/guides/setup
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/d/17aTgLnjMXIrfjgNaTUnHQO7m3xgzHR2VXBTmi03Qii4/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dom.spec.whatwg.org/#dom-event-stopimmediatepropagation
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dom.spec.whatwg.org/#interface-abortcontroller
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dom.spec.whatwg.org/#interface-eventtarget
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://domenic.me/)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://encoding.spec.whatwg.org
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://encoding.spec.whatwg.org/#encode-and-enqueue-a-chunk
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://encoding.spec.whatwg.org/#encode-and-flush
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://encoding.spec.whatwg.org/#textdecoder
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://encoding.spec.whatwg.org/#textencoder
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://feross.org
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://feross.org/opensource
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://feross.org/support
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#fetch-method
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#fetch-timing-info
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#headers-class
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#request-class
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#response-class
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/XVilka/8346728#gistcomment-2823421
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ChromeDevTools/devtools-frontend/blob/4275917f84266ef40613db3c1784a25f902ea74e/fr
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Cyan4973/xxHash
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/GoogleChrome/web-vitals
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/GoogleChromeLabs/text-fragments-polyfill
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/Vulkan-Headers
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/Vulkan-Loader
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Maratyszcza/pthreadpool
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Nicoshev/rapidhash
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Nicoshev/rapidhash/blob/master/rapidhash.h
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/PortAudio/portaudio/tree/master/src/common
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ReactiveX/rxjs
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/RyanZim/universalify#readme
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/RyanZim/universalify.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/STRML/async-limiter
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Sebmaster/tr46.js#readme
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Sebmaster/tr46.js.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/SeleniumHQ/selenium/tree/trunk
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Squirrel/Squirrel.Mac
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/TooTallNate/util-deprecate
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/TroyGoode)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/scheduling-apis
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WebAssembly/esm-integration/issues/42
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WebAssembly/wasm-c-api/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/aawc/unrar.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/addaleax/eventemitter-asyncresource
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/brailcom/speechd
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/brycebaril/node-stream-meter.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/calvinmetcalf/process-nextick-args
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/calvinmetcalf/process-nextick-args.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/ansi-regex/blob/HEAD/index.js
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/supports-color
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/wrap-ansi?sponsor=1
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorith
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/conventional-changelog/standard-version):
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/denoland/deno
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/denoland/deno/blob/main/LICENSE.md.
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/denoland/deno/blob/v1.29.1/ext/crypto/00_crypto.js#L195
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/dominictarr/rc.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/dpranke/typ.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/etingof/pyasn1
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/zstd
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/queue-microtask
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/run-parallel
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/safe-buffer
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/simple-concat
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/simple-get
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/fresc81/node-winreg
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.js
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/startSES.js
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/closure-compiler/wiki/Source-Maps
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/diff-match-patch/tree/master/javascript
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/distributed_point_functions
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/google-api-cpp-client/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/pprof/tree/master/proto
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/private-join-and-compute
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/protobuf
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/re2
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/ruy
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/securemessage
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/sentencepiece
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/shell-encryption
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/ukey2
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/wicked-good-xpath
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/woff2
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/wuffs-mirror-release-c
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/xnnpack
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/heycam/webidl/pull/946.
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-core-module
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-core-module.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-date-object/blob/main/index.js#L3-L11
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/node-supports-preserve-symlinks-flag#readme
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/node-supports-preserve-symlinks-flag.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/intel/libva
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/101)
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/102)
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/105)
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/106
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/99)
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/labels/wg-agenda
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/color-support.
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068737927
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068738228
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068738548
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068742592
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639071916
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639072106
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639072371
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639072571
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert)
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyent/node
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyent/node/issues/3295.
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jprichardson/node-fs-extra
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jprichardson/node-fs-extra/issues/269
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jrmuizel/qcms/tree/v4
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/webidl-conversions
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/webidl-conversions/blob/master/LICENSE.md.
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/lgeiger/node-abi/issues/54
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/libuv/libuv/pull/1088
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/libuv/libuv/pull/1501.
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/libuv/libuv/pull/2025.
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/pump
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-fs
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-fs.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-stream
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-stream.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mcollina/reusify#readme
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mcollina/reusify.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/micromatch/to-regex-range
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mikeal/tunnel-agent
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mysticatea/abort-controller
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/TSC/blob/master/Moderation-Policy.md
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node-v0.x-archive/issues/2876.
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/blob/master/CODE_OF_CONDUCT.md
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/blob/v10.8.0/lib/internal/errors.js
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/10673
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/19009
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/2006
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/3392
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/34532
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/35452
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/35475
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/35862
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/35981
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/39707
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/39758
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/44985
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/49472
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/51486
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/52219
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/8871#issuecomment-250915913
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/8987
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/12342
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/12607
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/13870#discussion_r124515293
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/26334.
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/30380#issuecomment-552948364
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/33515.
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/33661
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/3394
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/34010
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/34103#issuecomment-652002364
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/34375
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/34385
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/35407#issuecomment-700693439
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/35949#issuecomment-722496598
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/36061#discussion_r533718029
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/38248
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/38614)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/43714
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/46161
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/48477#issuecomment-1604586650
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/49891#issuecomment-1744673430.
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/string_decoder
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/normalize/mz
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/cli/blob/4c65cd952bc8627811735bea76b9b110cc4fc80e/lib/utils/ansi-trim.js
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-semver.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-tar/blob/51b6627a1f357d2eb433e7378e5f05e83b7aa6cd/lib/header.js#L349
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/wrappy
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/patrickhulce/third-party-web
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/prebuild/prebuild-install
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/prebuild/prebuild-install.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/protocolbuffers/protobuf-javascript
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/protocolbuffers/protobuf/blob/master/java/lite.md
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/puppeteer/puppeteer/tree/main/packages/puppeteer-core
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sass/node-sass/issues/1589#issuecomment-265292579
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/simplejson/simplejson
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/make-dir
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/os-homedir/blob/11e089f4754db38bb535e5a8416320c4446e8cfd/index.js
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sinonjs/fake-timers/blob/a4c757f80840829e45e0852ea1b17d87a998388e/src/fake-timers
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/broofa
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/ctavan
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/feross
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/ljharb
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/standard-things/esm/issues/821.
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tc39/ecma262/blob/HEAD/LICENSE.md
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tc39/ecma262/issues/1209
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tc39/proposal-iterator-helpers/issues/169
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tc39/proposal-ses/blob/e5271cc42a257a05dcae2fd94713ed2f46c08620/shim/src/freeze.j
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tc39/proposal-weakrefs
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/models
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/tensorflow
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/text.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/tflite-support
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/test262-utils/test262-harness-py
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/troygoode/node-require-directory/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/uuidjs/uuid.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/v8/v8/blob/6.0.122/test/mjsunit/fast-prototype.js#L48-L63
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068735040
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068735307
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068735697
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068736093
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068736404
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638965835
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638965968
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638966056
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638966247
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638966552
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615021
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615173
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615423
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615557
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615807
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/888438143
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/888438190
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/888438236
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/918633749
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/releases/download/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/wasdk/wasmparser
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws/issues/1202
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws/issues/1869.
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws/issues/1940.
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/xiph/rnnoise
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/y18n
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs#supported-nodejs-versions
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs-parser#supported-nodejs-versions
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs-parser.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs.git
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/zeux/volk
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/zorkow/speech-rule-engine
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gitlab.freedesktop.org/xorg/proto/xproto/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/t5IS6M).
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://hackerone.com/reports/541502
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#define-the-operations
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#dfn-default-iterator-object
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#dfn-iterator-prototype-object
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-interfaces
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-iterable
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-iterable-entries
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-iterators
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-namespaces
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-stringifier
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://hg.mozilla.org/mozilla-central/file/tip/netwerk/base/nsURLParsers.cpp
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/comms.html#the-websocket-interface
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/server-sent-events.html
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/server-sent-events.html#server-sent-events.org/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/web-messaging.html#broadcasting-to-other-browsing-contexts
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope.
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://invisible-island.net/ncurses/terminfo.ti.html#toc-_Specials
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/161903006
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://linux.die.net/man/1/dircolors).
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ltp.sourceforge.net/coverage/lcov/geninfo.1.php
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://medium.com/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://no-color.org/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodei.co/npm/require-directory.png?downloads=true&stars=true)
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodei.co/npm/require-directory/)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode).
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/api/fs.html
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/api/fs.html#fs_stat_time_values)
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/api/permissions.html#file-system-permissions
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/dist
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://npmjs.org/package/require-directory))
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://opensource.apple.com/source/xnu/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://polymer-library.polymer-project.org
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html).
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/pyparsing
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/six/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.python.org/pypi/pyfakefs
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.python.org/pypi/webapp2
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://quiche.googlesource.com/quiche
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://redux.js.org/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://secure.travis-ci.org/troygoode/node-require-directory.png)
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://semver.org/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sindresorhus.com
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sindresorhus.com)
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/site/gaviotachessengine/Home/endgame-tablebases-1
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sizzlejs.com/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://skia.org/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://source.chromium.org/chromium/chromium/src/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://source.corp.google.com/piper///depot/google3/third_party/tamachiyomi/README.md
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sourceforge.net/projects/wtl/files/WTL%2010/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sourcemaps.info/spec.html
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sqlite.org/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/a/5501711/3561
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://streams.spec.whatwg.org/#example-manual-write-with-backpressure
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://streams.spec.whatwg.org/#example-rbs-pull
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://swiftshader.googlesource.com/SwiftShader
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#eqn-modulo
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#sec-%typedarray%-intrinsic-object
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#sec-HostLoadImportedModule.
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#sec-timeclip
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#sec-tonumber
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#table-typeof-operator-results
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.prototype.tostring
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/security
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/security).
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2397#section-2
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc6455#section-1.3
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc6455#section-9.1
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.2
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7540#section-8.1.2.5
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tukaani.org/xz/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tukaani.org/xz/>.
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/intent/user?screen_name=troygoode)
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://unpkg.com/cliui
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://unpkg.com/yargs-parser
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#concept-url
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#concept-url-origin
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-parser
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-serializer
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-urlsearchparams-urlsearchparams
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#forbidden-host-code-point
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#special-scheme
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#url
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams-stringification-behavior
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://v8.dev/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://v8.dev/docs/stack-trace-api#customizing-stack-traces.
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://v8.dev/docs/stack-trace-api.
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/FileAPI/#creating-revoking
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/resource-timing/#dfn-mark-resource-timing
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/resource-timing/#dfn-setup-the-resource-timing-entry
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/resource-timing/#dom-performance-setresourcetimingbuffersize
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#the-integrity-attribute
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/webcrypto/#SubtleCrypto-method-wrapKey
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/webcrypto/#algorithm-normalization-normalize-an-algorithm
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webidl.spec.whatwg.org/#Exposed
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webidl.spec.whatwg.org/#Exposed.
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webidl.spec.whatwg.org/#abstract-opdef-converttoint
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webidl.spec.whatwg.org/#abstract-opdef-integerpart
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webidl.spec.whatwg.org/#es-DOMString
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webidl.spec.whatwg.org/#es-dictionary
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webidl.spec.whatwg.org/#es-invoking-callback-functions
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webkit.org/
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://websockets.spec.whatwg.org/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromium.org
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.cl.cam.ac.uk/%7Emgk25/ucs/utf8_check.c
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-line-terminators
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-promise.all
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.khronos.org/registry/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.khronos.org/spir/visualizer/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/wrap-ansi
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.opensource.org/licenses/bsd-license.php)
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.patreon.com/feross
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc8288.html#section-3
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.unicode.org/copyright.html.
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://xhr.spec.whatwg.org/#interface-formdata
Source: G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yargs.js.org/
Source: G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://zod.dev

System Summary

barindex
Drops large PE files
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile dump: Slax.exe.0.dr 188703744Jump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile dump: Slax.exe0.0.dr 188703744Jump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeProcess token adjusted: SecurityJump to behavior
Source: G4fDWS1Fpd.exeStatic PE information: invalid certificate
Source: Slax.exe.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: Slax.exe0.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: Slax.exe.0.drStatic PE information: Number of sections : 15 > 10
Source: Slax.exe0.0.drStatic PE information: Number of sections : 15 > 10
Source: G4fDWS1Fpd.exe, 00000000.00000003.1977419935.0000000005C36000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs G4fDWS1Fpd.exe
Source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevk_swiftshader.dll, vs G4fDWS1Fpd.exe
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dllb! vs G4fDWS1Fpd.exe
Source: G4fDWS1Fpd.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: mal60.spre.winEXE@32/109@0/0
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1144:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4428:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeMutant created: \Sessions\1\BaseNamedObjects\mfx_d3d_mutex
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeMutant created: \Sessions\1\BaseNamedObjects\c0a9b0da-fe7b-568f-ba03-753b28d39f41
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6524:120:WilError_03
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nsy8C82.tmpJump to behavior
Source: G4fDWS1Fpd.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SLAX.EXE'
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile read: C:\Users\user\Desktop\G4fDWS1Fpd.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\G4fDWS1Fpd.exe "C:\Users\user\Desktop\G4fDWS1Fpd.exe"
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Slax.exe" /FO csv | "C:\Windows\system32\find.exe" "Slax.exe"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Slax.exe" /FO csv
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe "C:\Windows\system32\find.exe" "Slax.exe"
Source: unknownProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe"
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1760,i,7052398392554665292,13112330197020623340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2528,i,7052398392554665292,13112330197020623340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
Source: unknownProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe"
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1740,i,15859010876315112086,12757602484505537374,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2400,i,15859010876315112086,12757602484505537374,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1224,i,7052398392554665292,13112330197020623340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2504,i,15859010876315112086,12757602484505537374,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Slax.exe" /FO csv | "C:\Windows\system32\find.exe" "Slax.exe"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Slax.exe" /FO csv Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe "C:\Windows\system32\find.exe" "Slax.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1760,i,7052398392554665292,13112330197020623340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2528,i,7052398392554665292,13112330197020623340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1224,i,7052398392554665292,13112330197020623340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1740,i,15859010876315112086,12757602484505537374,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2400,i,15859010876315112086,12757602484505537374,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: iconcodecservice.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dllJump to behavior
Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mscms.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: coloradapterclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mmdevapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: devobj.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: duser.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: xmllite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: atlthunk.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mf.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mfplat.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: rtworkq.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mscms.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: coloradapterclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mmdevapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: devobj.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mf.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mfplat.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: rtworkq.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mpr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: scrrun.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: d3d12core.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dxilconv.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: d3dscache.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: directml.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: d3d12core.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: dxilconv.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: d3dscache.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: directml.dll
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeSection loaded: cabinet.dll
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Slax.exe" /FO csv
Source: MyElectronApp.lnk.14.drLNK file: ..\..\..\..\..\..\Local\Programs\Slax\Slax.exe
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\c0a9b0da-fe7b-568f-ba03-753b28d39f41Jump to behavior
Source: G4fDWS1Fpd.exeStatic file information: File size 86638456 > 1048576
Source: G4fDWS1Fpd.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: vulkan-1.dll.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.2072490673.0000000005A90000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2078215891.0000000006610000.00000004.00001000.00020000.00000000.sdmp, G4fDWS1Fpd.exe, 00000000.00000003.2072043165.00000000030C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vk_swiftshader.dll.pdb source: G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmp
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .retplne
Source: vk_swiftshader.dll.0.drStatic PE information: section name: _RDATA
Source: vulkan-1.dll.0.drStatic PE information: section name: .gxfg
Source: vulkan-1.dll.0.drStatic PE information: section name: .retplne
Source: vulkan-1.dll.0.drStatic PE information: section name: _RDATA
Source: ffmpeg.dll.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll.0.drStatic PE information: section name: _RDATA
Source: libEGL.dll.0.drStatic PE information: section name: .gxfg
Source: libEGL.dll.0.drStatic PE information: section name: .retplne
Source: libEGL.dll.0.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll.0.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll.0.drStatic PE information: section name: .retplne
Source: libGLESv2.dll.0.drStatic PE information: section name: _RDATA
Source: ffmpeg.dll0.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll0.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll0.0.drStatic PE information: section name: _RDATA
Source: libEGL.dll0.0.drStatic PE information: section name: .gxfg
Source: libEGL.dll0.0.drStatic PE information: section name: .retplne
Source: libEGL.dll0.0.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll0.0.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll0.0.drStatic PE information: section name: .retplne
Source: libGLESv2.dll0.0.drStatic PE information: section name: _RDATA
Source: Slax.exe.0.drStatic PE information: section name: .gxfg
Source: Slax.exe.0.drStatic PE information: section name: .retplne
Source: Slax.exe.0.drStatic PE information: section name: .rodata
Source: Slax.exe.0.drStatic PE information: section name: CPADinfo
Source: Slax.exe.0.drStatic PE information: section name: LZMADEC
Source: Slax.exe.0.drStatic PE information: section name: _RDATA
Source: Slax.exe.0.drStatic PE information: section name: malloc_h
Source: Slax.exe.0.drStatic PE information: section name: prot
Source: fastlist-0.3.0-x64.exe.0.drStatic PE information: section name: _RDATA
Source: Slax.exe0.0.drStatic PE information: section name: .gxfg
Source: Slax.exe0.0.drStatic PE information: section name: .retplne
Source: Slax.exe0.0.drStatic PE information: section name: .rodata
Source: Slax.exe0.0.drStatic PE information: section name: CPADinfo
Source: Slax.exe0.0.drStatic PE information: section name: LZMADEC
Source: Slax.exe0.0.drStatic PE information: section name: _RDATA
Source: Slax.exe0.0.drStatic PE information: section name: malloc_h
Source: Slax.exe0.0.drStatic PE information: section name: prot
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Programs\Slax\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Programs\Slax\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\nsExec.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Programs\Slax\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\SpiderBanner.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exeJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Programs\Slax\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exeJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\Slax.exeJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile created: C:\Users\user\AppData\Local\Programs\Slax\LICENSE.electron.txtJump to behavior

Boot Survival

barindex
Powershell creates an autostart link
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: .lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell engine required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module via navigations and search. Tags = @('powershell','unit testing','bdd','tdd','mocking') # The web address of an icon which can be used
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: .lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell engine required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module via navigations and search. Tags = @('powershell','unit testing','bdd','tdd','mocking') # The web address of an icon which can be used
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnkJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnkJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2060Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3985Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2633
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1218
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Slax\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\nsExec.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Slax\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\SpiderBanner.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exeJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Slax\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exeJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2028Thread sleep count: 2060 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2028Thread sleep count: 3985 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1908Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2448Thread sleep time: -1844674407370954s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6064Thread sleep count: 2633 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6064Thread sleep count: 1218 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1596Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5804Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeFile Volume queried: C:\Users\user\AppData\Local\Programs\Slax FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeFile Volume queried: C:\Users\user\AppData\Local\Programs\Slax FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeFile Volume queried: C:\Users\user FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeFile Volume queried: C:\Users\user FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeFile Volume queried: C:\Users\user\AppData\Local\Programs\Slax FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeFile Volume queried: C:\Users\user\AppData\Local\Programs\Slax FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeFile Volume queried: C:\Users\user FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeFile Volume queried: C:\Users\user FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resourcesJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendorJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpackedJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpacked\node_modulesJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-listJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeFile opened: C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\localesJump to behavior
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: bCK1sK9IRQq9qEmUv4RDsNuESgMjGWdqb8FuvAY5N9GIIvejQjBAMA8GA1UdEwEB/wQFMAMB
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMware
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: (IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSDKVersion() < 27 && IsAdreno5xxOrOlder(functions)) || (!isMesa && IsMaliT8xxOrOlder(functions)) || (!isMesa && IsMaliG31OrOlder(functions))
Source: G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ZAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTestp
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\G4fDWS1Fpd.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Slax.exe" /FO csv | "C:\Windows\system32\find.exe" "Slax.exe"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Slax.exe" /FO csv Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe "C:\Windows\system32\find.exe" "Slax.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1760,i,7052398392554665292,13112330197020623340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2528,i,7052398392554665292,13112330197020623340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1224,i,7052398392554665292,13112330197020623340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1740,i,15859010876315112086,12757602484505537374,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2400,i,15859010876315112086,12757602484505537374,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\slax" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1760,i,7052398392554665292,13112330197020623340,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\slax\slax.exe';$s.save()""
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\slax" --field-trial-handle=2528,i,7052398392554665292,13112330197020623340,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\slax" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1740,i,15859010876315112086,12757602484505537374,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\slax\slax.exe';$s.save()""
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\slax" --field-trial-handle=2400,i,15859010876315112086,12757602484505537374,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\slax" --gpu-preferences=uaaaaaaaaadoaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaabcaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1224,i,7052398392554665292,13112330197020623340,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\slax" --gpu-preferences=uaaaaaaaaadoaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaabcaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=2504,i,15859010876315112086,12757602484505537374,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\slax" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1760,i,7052398392554665292,13112330197020623340,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\slax\slax.exe';$s.save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\slax" --field-trial-handle=2528,i,7052398392554665292,13112330197020623340,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\slax" --gpu-preferences=uaaaaaaaaadoaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaabcaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1224,i,7052398392554665292,13112330197020623340,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\slax" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1740,i,15859010876315112086,12757602484505537374,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\slax\slax.exe';$s.save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeProcess created: C:\Users\user\AppData\Local\Programs\Slax\Slax.exe "c:\users\user\appdata\local\programs\slax\slax.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\slax" --field-trial-handle=2400,i,15859010876315112086,12757602484505537374,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users\user\AppData VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users\user\AppData\Local VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users\user\AppData\Local\Programs VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Slax VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users\user\AppData\Roaming\Slax\Local State VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users\user\AppData\Roaming\Slax\config.json VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Users\user\AppData\Roaming\Slax\config.json VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Slax\Slax.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Windows Management Instrumentation		1
Windows Service		1
Windows Service		1
Masquerading		OS Credential Dumping1
Security Software Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Command and Scripting Interpreter		12
Registry Run Keys / Startup Folder		11
Process Injection		21
Virtualization/Sandbox Evasion		LSASS Memory2
Process Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
PowerShell		1
DLL Side-Loading		12
Registry Run Keys / Startup Folder		11
Process Injection		Security Account Manager21
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
DLL Side-Loading		1
DLL Side-Loading		NTDS1
Application Window Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets1
Remote System Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials2
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync34
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1556260 Sample: G4fDWS1Fpd.exe Startdate: 15/11/2024 Architecture: WINDOWS Score: 60 59 Sigma detected: Powershell create lnk in startup 2->59 61 Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE 2->61 7 G4fDWS1Fpd.exe 11 226 2->7         started        11 Slax.exe 4 2->11         started        13 Slax.exe 1 2->13         started        process3 file4 49 C:\Users\user\AppData\Local\...\Slax.exe, PE32+ 7->49 dropped 51 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 7->51 dropped 53 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 7->53 dropped 55 17 other files (none is malicious) 7->55 dropped 63 Drops large PE files 7->63 15 cmd.exe 1 7->15         started        17 cmd.exe 1 11->17         started        19 Slax.exe 1 11->19         started        21 Slax.exe 1 11->21         started        23 Slax.exe 11->23         started        25 cmd.exe 13->25         started        27 Slax.exe 1 13->27         started        29 Slax.exe 1 13->29         started        31 Slax.exe 13->31         started        signatures5 process6 process7 33 conhost.exe 15->33         started        35 tasklist.exe 1 15->35         started        37 find.exe 1 15->37         started        39 powershell.exe 17 17->39         started        43 conhost.exe 17->43         started        45 conhost.exe 25->45         started        47 powershell.exe 25->47         started        file8 57 C:\Users\user\AppData\...\MyElectronApp.lnk, MS 39->57 dropped 65 Powershell creates an autostart link 39->65 signatures9

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
G4fDWS1Fpd.exe0%ReversingLabs
G4fDWS1Fpd.exe0%VirustotalBrowse

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Programs\Slax\Slax.exe0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Slax\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Slax\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Slax\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Slax\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\Slax.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\elevate.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\vulkan-1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse8E29.tmp\SpiderBanner.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse8E29.tmp\StdUtils.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse8E29.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse8E29.tmp\nsExec.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse8E29.tmp\nsis7z.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://tukaani.org/xz/&gt;.0%Avira URL Cloudsafe
https://secure.travis-ci.org/troygoode/node-require-directory.png)0%Avira URL Cloudsafe
https://nodei.co/npm/require-directory/)0%Avira URL Cloudsafe
http://fresc81.github.io/node-winreg0%Avira URL Cloudsafe
https://html.spec.whatwg.org/multipage/server-sent-events.html#server-sent-events.org/0%Avira URL Cloudsafe
https://tukaani.org/xz/&gt;.0%VirustotalBrowse
https://secure.travis-ci.org/troygoode/node-require-directory.png)0%VirustotalBrowse
https://html.spec.whatwg.org/multipage/server-sent-events.html#server-sent-events.org/0%VirustotalBrowse
http://fresc81.github.io/node-winreg0%VirustotalBrowse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://github.com/lgeiger/node-abi/issues/54G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
    		high
    https://github.com/mcollina/reusify#readmeG4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
      		high
      https://url.spec.whatwg.org/#concept-url-originG4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
        		high
        https://github.com/simplejson/simplejsonG4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpfalse
          		high
          https://tools.ietf.org/html/rfc6455#section-1.3G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
            		high
            https://github.com/prebuild/prebuild-installG4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
              		high
              https://github.com/vercel/pkg-fetch/actions/runs/2638965835G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                https://github.com/jesec/pkg-fetch/actions/runs/2639072106G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                  		high
                  http://anglebug.com/42262161G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                    		high
                    https://github.com/feross/queue-microtaskG4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                      		high
                      http://anglebug.com/42263010G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        https://console.spec.whatwg.org/#tableG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          http://anglebug.com/42262286G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            https://github.com/nodejs/string_decoderG4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              http://anglebug.com/42262166G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                		high
                                http://anglebug.com/42262287G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high
                                  https://secure.travis-ci.org/troygoode/node-require-directory.png)G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                  • 0%, Virustotal, Browse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://encoding.spec.whatwg.org/#textencoderG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                    		high
                                    https://www.patreon.com/ferossG4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		high
                                      https://github.com/tc39/proposal-weakrefsG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                        		high
                                        https://goo.gl/t5IS6M).G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		high
                                          https://github.com/vercel/pkg-fetch/actions/runs/2638965968G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		high
                                            https://github.com/nodejs/node/issues/44985G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.jsG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://anglebug.com/42265782G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://url.spec.whatwg.org/#concept-urlencoded-serializerG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://url.spec.whatwg.org/#dom-urlsearchparams-urlsearchparamsG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://yargs.js.org/G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://semver.org/G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://github.com/google/pprof/tree/master/protoG4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://github.com/jrmuizel/qcms/tree/v4G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://nodejs.org/api/fs.htmlG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://npmjs.org/package/require-directory))G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://chromium.googlesource.com/chromium/src/G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://www.midnight-commander.org/browser/lib/tty/key.cG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://nodejs.org/G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://tools.ietf.org/html/rfc7540#section-8.1.2.5G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://github.com/tensorflow/modelsG4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://github.com/KhronosGroup/SPIRV-Headers.gitG4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://tc39.es/ecma262/#sec-timeclipG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://anglebug.com/42263031G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://issuetracker.google.com/161903006G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://nodei.co/npm/require-directory/)G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    https://github.com/nodejs/node/pull/33661G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWithG4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://anglebug.com/42263158G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://github.com/tensorflow/tflite-supportG4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://github.com/WICG/scheduling-apisG4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://github.com/nodejs/node/pull/48477#issuecomment-1604586650G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://pypi.org/project/pyparsingG4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://sqlite.org/G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://code.google.com/p/v8/wiki/JavaScriptStackTraceApiG4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://code.google.com/p/chromium/issues/detail?id=25916G4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://webidl.spec.whatwg.org/#abstract-opdef-converttointG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://www.opensource.org/licenses/mit-license.php)G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://stackoverflow.com/a/1068308/13216G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://github.com/jesec/pkg-fetch/actions/runs/2639072371G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://twitter.com/intent/user?screen_name=troygoode)G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://fetch.spec.whatwg.org/#fetch-timing-infoG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://html.spec.whatwg.org/multipage/server-sent-events.html#server-sent-events.org/G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                    • 0%, Virustotal, Browse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    		unknown
                                                                                                                    https://github.com/libuv/libuv/pull/1088G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://github.com/nodejs/node/pull/12607G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://tukaani.org/xz/&gt;.G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                        • 0%, Virustotal, Browse
                                                                                                                        • Avira URL Cloud: safe
                                                                                                                        		unknown
                                                                                                                        https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope.G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://www.ecma-international.org/ecma-262/#sec-line-terminatorsG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://fresc81.github.io/node-winregG4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                            • 0%, Virustotal, Browse
                                                                                                                            • Avira URL Cloud: safe
                                                                                                                            		unknown
                                                                                                                            https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txtG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://sizzlejs.com/G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://anglebug.com/42263049G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://anglebug.com/40644663G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://anglebug.com/42262249G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://medium.com/G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        http://www.portaudio.comG4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://github.com/ChromeDevTools/devtools-frontend/blob/4275917f84266ef40613db3c1784a25f902ea74e/frG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://www.unicode.org/copyright.htmlG4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://github.com/inspect-js/node-supports-preserve-symlinks-flag.gitG4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://github.com/vercel/pkg-fetch/actions/runs/2068735040G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://github.com/vercel/pkg-fetch/actions/runs/752615557G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://github.com/RyanZim/universalify.gitG4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://github.com/google/shell-encryptionG4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://heycam.github.io/webidl/#es-iterable-entriesG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://github.com/wasdk/wasmparserG4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://heycam.github.io/webidl/#es-interfacesG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              http://anglebug.com/42266725G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://anglebug.com/42262247G4fDWS1Fpd.exe, 00000000.00000003.1981511619.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://unpkg.com/cliuiG4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://github.com/nodejs/node/issuesG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://github.com/denoland/deno/blob/main/LICENSE.md.G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://encoding.spec.whatwg.org/#encode-and-enqueue-a-chunkG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://tc39.github.io/ecma262/#sec-object.prototype.tostringG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://url.spec.whatwg.org/#urlsearchparamsG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://github.com/dpranke/typ.gitG4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://github.com/nodejs/node/issues/8987G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://github.com/vercel/pkg-fetch/actions/runs/752615423G4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://streams.spec.whatwg.org/#example-manual-write-with-backpressureG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://github.com/nodejs/node/pull/30380#issuecomment-552948364G4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setintervalG4fDWS1Fpd.exe, 00000000.00000003.2079400928.0000000006E10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://www.khronos.org/registry/G4fDWS1Fpd.exe, 00000000.00000003.1953631119.0000000005C10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://github.com/sponsors/ferossG4fDWS1Fpd.exe, 00000000.00000003.1972422029.0000000005710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              https://heycam.github.io/webidl/#dfn-iterator-prototype-objectG4fDWS1Fpd.exe, 00000000.00000003.2078748729.0000000006A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high

                                                                                                                                                                                                World Map of Contacted IPs

                                                                                                                                                                                                ⊘No contacted IP infos

                                                                                                                                                                                                General Information

                                                                                                                                                                                                Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                Analysis ID:1556260
                                                                                                                                                                                                Start date and time:2024-11-15 08:26:26 +01:00
                                                                                                                                                                                                Joe Sandbox product:CloudBasic
                                                                                                                                                                                                Overall analysis duration:0h 9m 52s
                                                                                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                                                                                Report type:full
                                                                                                                                                                                                Cookbook file name:default.jbs
                                                                                                                                                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                Run name:Run with higher sleep bypass
                                                                                                                                                                                                Number of analysed new started processes analysed:25
                                                                                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                                                                                Number of existing processes analysed:0
                                                                                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                                                                                Number of injected processes analysed:0
                                                                                                                                                                                                Technologies:
                                                                                                                                                                                                • HCA enabled
                                                                                                                                                                                                • EGA enabled
                                                                                                                                                                                                • AMSI enabled
                                                                                                                                                                                                Analysis Mode:default
                                                                                                                                                                                                Analysis stop reason:Timeout
                                                                                                                                                                                                Sample name:G4fDWS1Fpd.exe
                                                                                                                                                                                                renamed because original name is a hash value
                                                                                                                                                                                                Original Sample Name:fac7f1a54eef98830ecbd25fef364695b8afd9e255dcc19702dac84ee526c5ca.exe
                                                                                                                                                                                                Detection:MAL
                                                                                                                                                                                                Classification:mal60.spre.winEXE@32/109@0/0
                                                                                                                                                                                                EGA Information:Failed
                                                                                                                                                                                                HCA Information:
                                                                                                                                                                                                • Successful, ratio: 100%
                                                                                                                                                                                                • Number of executed functions: 0
                                                                                                                                                                                                • Number of non-executed functions: 0
                                                                                                                                                                                                Cookbook Comments:
                                                                                                                                                                                                • Found application associated with file extension: .exe
                                                                                                                                                                                                • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                                                                                                                                                                • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

                                                                                                                                                                                                Warnings

                                                                                                                                                                                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                                                                                • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtQueryVolumeInformationFile calls found.

                                                                                                                                                                                                Simulations

                                                                                                                                                                                                Behavior and APIs

                                                                                                                                                                                                TimeTypeDescription
                                                                                                                                                                                                07:28:13AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk

                                                                                                                                                                                                Joe Sandbox View / Context

                                                                                                                                                                                                IPs

                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                Domains

                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                ASNs

                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                JA3 Fingerprints

                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                Dropped Files

                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                C:\Users\user\AppData\Local\Programs\Slax\d3dcompiler_47.dlla2zZyepQzF.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                  kCKthbZCUf.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    a2zZyepQzF.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                      kCKthbZCUf.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        cMqyGFCQHk.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          cMqyGFCQHk.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            Soltix.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                              Soltix.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                Prismifyr_Installer_v2.1 Setup 1.0.0.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                  Created / dropped Files

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\D3DSCache\936c00a8a22f7407\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):65552
                                                                                                                                                                                                                  Entropy (8bit):0.012649089440725928
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:mZ9llGlll/l/lXp9ZjrPBY0llltOXRP:mZ9l0dPBY0l/U5
                                                                                                                                                                                                                  MD5:A585AA95FB7728A6B91B17C2579F18AA
                                                                                                                                                                                                                  SHA1:572ED45987E8AE1DDABDBFBE9AE6AD2AED91A8DB
                                                                                                                                                                                                                  SHA-256:05494C0AE08BD47A29EFDEE9426AB102C1A5A4AD768698963164DD7A38C0B08E
                                                                                                                                                                                                                  SHA-512:376311E53D9291EAB3293B79DEE89E23578ADF91406FBFB4377CA2B9D5DC8DC4255C912E9BF6F4A9D79CA0F7A7A337D520029F52F8C00B61DFD08E9157B4C84A
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:!*..........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\D3DSCache\936c00a8a22f7407\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:modified
                                                                                                                                                                                                                  Size (bytes):4
                                                                                                                                                                                                                  Entropy (8bit):1.5
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:R:R
                                                                                                                                                                                                                  MD5:F49655F856ACB8884CC0ACE29216F511
                                                                                                                                                                                                                  SHA1:CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
                                                                                                                                                                                                                  SHA-256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
                                                                                                                                                                                                                  SHA-512:599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:EERF

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\D3DSCache\936c00a8a22f7407\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                                                                                  File Type:Matlab v4 mat-file (little endian) (, numeric, rows 0, columns 16, imaginary
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):65536
                                                                                                                                                                                                                  Entropy (8bit):0.025124577296203036
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:9llvlVbd2DJqojrwRAal0dhOEjlpQlyEXl1lAbl7keHjl2lQHRldtt3llaia9sVu:q9q0sRKUEZ+lX1IbRl52lQjdtT2Hrn
                                                                                                                                                                                                                  MD5:B131D50CCAA6A983ADC4973CDBE2B2E1
                                                                                                                                                                                                                  SHA1:8D57F2B9EF5EBB089DC5947A8CEE317D91577D3F
                                                                                                                                                                                                                  SHA-256:6B26C0FA4E770683F691E48B92AC66A76A895652CF74371DC9BE1CB7A8580F8A
                                                                                                                                                                                                                  SHA-512:E2D3FB4C431B53FBDA0CD04508041DD9D54C0DA83DF92AD71F5234906906DEDA18D6C595E03A4921EA5D1D363E51C98F612E146463EA19EE1800782F769E24D5
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:................h...(....x:no.&A.e.u~+..C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.S.l.a.x.\.S.l.a.x...e.x.e.......................(...p.DJ!.IL.....Zm.F............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):64
                                                                                                                                                                                                                  Entropy (8bit):0.34726597513537405
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Nlll:Nll
                                                                                                                                                                                                                  MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                                                                                                                                                                  SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                                                                                                                                                                  SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                                                                                                                                                                  SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:@...e...........................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Slax\LICENSE.electron.txt

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:ASCII text
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1096
                                                                                                                                                                                                                  Entropy (8bit):5.13006727705212
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                  MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                                                  SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                                                  SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                                                  SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Slax\LICENSES.chromium.html

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:HTML document, ASCII text
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):9099045
                                                                                                                                                                                                                  Entropy (8bit):4.754770173605162
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24576:2o9dQ06p6j6j1WOwRiXjYmfy6k6mjK64jK6gjK6e6cjK6feGjl8PpE:BFOeGT
                                                                                                                                                                                                                  MD5:6FF57C0AECCDF44C39C95DEE9ECEA805
                                                                                                                                                                                                                  SHA1:C76669A1354067A1C3DDBC032E66C323286A8D43
                                                                                                                                                                                                                  SHA-256:0BA4C7B781E9F149195A23D3BE0F704945F858A581871A9FEDD353F12CE839CA
                                                                                                                                                                                                                  SHA-512:D6108E1D1D52AA3199FF051C7B951025DBF51C5CB18E8920304116DCEF567367ED682245900FDA3AD354C5D50AA5A3C4E6872570A839A3A55D3A9B7579BDFA24
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Slax\Slax.exe

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):188703744
                                                                                                                                                                                                                  Entropy (8bit):6.7582799459614025
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:1572864:bwl41lgY+w9QLv1JWYc6UeOtUUGQUT1jdu4BPPuuwT2GOqiB1sr7zjg7ob753oUV:RF4oD0QdG09P
                                                                                                                                                                                                                  MD5:262797985453830673179336B6BACAC6
                                                                                                                                                                                                                  SHA1:E8AB15D4C8606CF1341F2CD7EF27F69145C0F372
                                                                                                                                                                                                                  SHA-256:663C85DDB2BDA40E449BFD73F2E13E8B5C007240266F1440DFC42ECE6E2D36CC
                                                                                                                                                                                                                  SHA-512:C95598F7DDC560AE9110201D354F61D8621EC8AF83E93E550DFE58B10C1DF0BE060ECDABAAB0CE4A2DCFC2B77152A044E3B824BEB4623958D388EC6A5C63D925
                                                                                                                                                                                                                  Malicious:true
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."......FH.........`IY........@.............................p~...........`..........................................d..k...0...h....`m.H.....#...H..........0o..5..P.......................0...(....}H.@............................................text...*DH......FH................. ..`.rdata.......`H......LH.............@..@.data....H......L..................@....pdata....H...#...H.................@..@.gxfg....B...pl..D....-.............@..@.retplne......l......*...................rodata.......l......,.............. ..`.tls..........l......>..............@...CPADinfo8.....m......D..............@...LZMADEC.......m......F.............. ..`_RDATA.......0m......X..............@..@malloc_h.....@m......Z.............. ..`prot.........Pm......\..............@..@.rsrc...H....`m......^..............@..@.reloc...5...0o..6....0.............@..B................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Slax\chrome_100_percent.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):151599
                                                                                                                                                                                                                  Entropy (8bit):7.915992368779121
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
                                                                                                                                                                                                                  MD5:83EC43F2AF9FC52025F3F807B185D424
                                                                                                                                                                                                                  SHA1:EA432F7571D89DD43A76D260CB5853CADA253AA0
                                                                                                                                                                                                                  SHA-256:A659EE9EB38636F85F5336587C578FB29740D3EFFAFF9B92852C8A210E92978C
                                                                                                                                                                                                                  SHA-512:6DDCA85215BF6F7F9B17C5D52BD7395702515BC2354A8CD8FA6C1CCD7355A23B17828853CEABEEF597B5BCA11750DC7C9F6EC3C45A33C2106F816FEC74963D86
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:..........<.............h.....i.\...j.....k.I...l.....n.....o.....p.:...q.4...r.o...s.?...t..!..u..%..v.@'..w..1..x..<..y.l?..z..C..{..G..|..I..}..J..~..M.....O.....R....|V.....Z.....]....N`.....a....3c....gd.....e....@g.....g.....m....~s....Fw....&{.....~..........*.....m................8..........._...........1....V.............w....e........F.........'....Z....k....5...,.....-.h........./.....0.!...1.....6.f...7.....8..!....$....&...../.....1.....5....3:....CE.....F....(O.....U....b[.....`....g....^i.....m.....q....V{....v~..............R...............X.....#.................................................|.....S..........W...........i..........2.....`...........S...........S.....(............................s...........y.....N.....".......................&.............................................Q"....-#.....#....$....v%....?&.....&....*(.... ).....*...........2....33....3.....3.....4....5....v6.....6.....7....f7....7.....7.....>.....A....sB

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Slax\chrome_200_percent.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):228644
                                                                                                                                                                                                                  Entropy (8bit):7.946488830213853
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
                                                                                                                                                                                                                  MD5:DC48A33BD20BFC7CACFC925A84B015B6
                                                                                                                                                                                                                  SHA1:8DFEE88FD1DC77F89AD88C19146FE3AB45E43F3C
                                                                                                                                                                                                                  SHA-256:2C1B3E4B8A0CF837AE0A390FCA54F45D7D22418E040F1DFEA979622383ACCED6
                                                                                                                                                                                                                  SHA-512:1D54EB5D2BA06AF0BA8F6B491B0D43F178A48AC82CDF383BEB265E732DDFC06BCA9692003FDFCE56F7F00AF97F29ACF046C73B891B8C561610098F9626EAF05A
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:..........<.........&...h.....i.....j.....k.....l.....n.....o.|%..p..*..q..-..r.85..s..:..t..>..u.CG..v..K..w.._..x._t..y.{y..z....{.4...|....}.m...~...............................................h.............................5.................t...........-.................D............$.....-....K9.....@....FH...bL...9O...nT...)U...jV...UZ....]...s`...xc...f....j...n..,.\r..-..s....ku../..v..0..w..1.Dx..6..x..7.....8.Q............................F................S..........{...........^.....@...........!....%....&/....R2....:....>....RH....R.....V....|X....Sa.....i....k.....n.....r.....y.....{....%..........`.....7...........................................0.....I..........;.....l.....b.....B.....%.....S.....m..........L...........R..........V...........g.....)........................!.....'....-....u3.....4.....5.....6.....8....:9.....:.....<....=....`?....$L.....\....v\.....\....;].....]....._....._....K`....`.....a....]a....a.....g.....k....Rl

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Slax\d3dcompiler_47.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):4916728
                                                                                                                                                                                                                  Entropy (8bit):6.398031738914566
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
                                                                                                                                                                                                                  MD5:A7B7470C347F84365FFE1B2072B4F95C
                                                                                                                                                                                                                  SHA1:57A96F6FB326BA65B7F7016242132B3F9464C7A3
                                                                                                                                                                                                                  SHA-256:AF7B99BE1B8770C0E4D18E43B04E81D11BDEB667FA6B07ADE7A88F4C5676BF9A
                                                                                                                                                                                                                  SHA-512:83391A219631F750499FD9642D59EC80FB377C378997B302D10762E83325551BB97C1086B181FFF0521B1CA933E518EAB71A44A3578A23691F215EBB1DCE463D
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Joe Sandbox View:
                                                                                                                                                                                                                  • Filename: a2zZyepQzF.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  • Filename: kCKthbZCUf.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  • Filename: a2zZyepQzF.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  • Filename: kCKthbZCUf.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  • Filename: cMqyGFCQHk.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  • Filename: cMqyGFCQHk.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  • Filename: Soltix.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  • Filename: Soltix.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  • Filename: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K......JK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Slax\ffmpeg.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):2929152
                                                                                                                                                                                                                  Entropy (8bit):6.70454100720416
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:49152:ZBAnytEwrZu/3Q8rvnh2UGH6qfhtvRIdefZiC6Cry2:ZBFE6kfbrvnh21K+io
                                                                                                                                                                                                                  MD5:5A168CB3EA9D0E7400BAABF60F6AB933
                                                                                                                                                                                                                  SHA1:82A86CB7F42294AB4AD6669C19B92605D960B676
                                                                                                                                                                                                                  SHA-256:AF5F1BC9F6A73750FA0C7BF17439700CFB3AB23E1393F0C9899825417E319B54
                                                                                                                                                                                                                  SHA-512:7C1441ECD049543E38297A7B6929E9F3EB978422D0CE508FBE6350FFEBD297F947B8D9EC75BD2054142DCD8461EEF1BF110E040D0830DA977FDE8944BECE843D
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......#...................................................:...........`A..........................................*.......*.(.............9..............:.<5....*.......................*.(.....$.@...........H.*.8............................text.....#.......#................. ..`.rdata........$.......#.............@..@.data.........+.."....+.............@....pdata.......9.......+.............@..@.gxfg....+...0:..,...J,.............@..@.retplne.....`:......v,..................tls.........p:......x,.............@..._RDATA........:......z,.............@..@.reloc..<5....:..6...|,.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Slax\icudtl.dat

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):10468208
                                                                                                                                                                                                                  Entropy (8bit):6.265606239082294
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
                                                                                                                                                                                                                  MD5:FFD67C1E24CB35DC109A24024B1BA7EC
                                                                                                                                                                                                                  SHA1:99F545BC396878C7A53E98A79017D9531AF7C1F5
                                                                                                                                                                                                                  SHA-256:9AE98C06CBB0EA43C5CD6B5725310C008C65E46072421A1118CB88E1DE9A8B92
                                                                                                                                                                                                                  SHA-512:E1A865E685D2D3BACD0916D4238A79462519D887FEB273A251120BB6AF2B4481D025F3B21CE9A1A95A49371A0AA3ECF072175BA756974E831DBFDE1F0FEAEB79
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E...(...E...)...F...).."F...1..5F..`1..EF...N..XF..PN..hF...N..xF.......F.......F.......F..@....F.......F......F..0....F.......G......$G......7G......JG......]G..@...pG.......G.......G..@....G.......G.......G..@....G.......G..p....H..`....H.......H..@...AH......TH..p...gH.....zH.......H..`....H.......H.......H..P....H.......H......H..`....I......%I..P...:I......RI.....bI..@...uI.......I.......I.......I..P....I.......I.......I..0....I.......J... ...J.. !..-J..@$..=J...$..PJ...$..qJ.......J...<...J....&..J....&..J.. .&..J....&..K..`.&..K....&.3K....&.JK..0.&.aK....'.xK....'..K....'..K...(..K....(..K...O)..K....)..L..0Q*.>L..`.*.gL..Pi+..L....+..L...i,..L....,..L..P}-..M..@.-.,M.. .-.EM....-.\M....-.uM....-..M...$...M..0%...M....0..M...j0..M..`.0..N..p.0.1N....0.AN....0.TN..@.0.iN....0..N..0.0..N....0..N....0..N....1..N....1..N..

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Slax\libEGL.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):493056
                                                                                                                                                                                                                  Entropy (8bit):6.3672588781107775
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:0PfRujpqWG9btH+M1wLPfj9iDcHetGsHUN0dxI2H6sNkD4Fvh2W:eAWt+MWLPfjkVGbN0dxI2H63D4Bh2
                                                                                                                                                                                                                  MD5:39CCF402A62F068A8C573B45EA96154D
                                                                                                                                                                                                                  SHA1:57CEB915EA6F88C7FCCA35339BF951659C0338AB
                                                                                                                                                                                                                  SHA-256:8649D77ACE8E5753B9A10E7AE3349AAFA9D8E3406BA9C8C36A59633A84B3C41B
                                                                                                                                                                                                                  SHA-512:C4F9225C54D413176CB3DD2B26D429493FD056C7C283BC7A1C52B4A2059DBB11380DAF5D847BE1FF29F058BA0EF44D4BF66A3D9E9A600000DC8F6D20DFB2ED03
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .....l................................................................`A.........................................l......h{..(.......x....P..l?..............<....d.......................c..(.......@...........p~...............................text....k.......l.................. ..`.rdata..lr.......t...p..............@..@.data....K....... ..................@....pdata..l?...P...@..................@..@.gxfg... &.......(...D..............@..@.retplne.............l...................tls....!............n..............@..._RDATA...............p..............@..@.rsrc...x............r..............@..@.reloc..<............x..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Slax\libGLESv2.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):8418304
                                                                                                                                                                                                                  Entropy (8bit):6.508090684401189
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:98304:Q7XpFwEPVsR+1HYJnahAB4tVsX43wYMg:QXVrAtsw
                                                                                                                                                                                                                  MD5:F055A130C79BD517BDB53B1F8A38BD3B
                                                                                                                                                                                                                  SHA1:9FBA0AD4BA973BB285B23CC125004BAF61A98B5A
                                                                                                                                                                                                                  SHA-256:45B53759392B81CE7D916B3F1CF02BE30289809BD31D09FC1524EF2609183B17
                                                                                                                                                                                                                  SHA-512:D9DCB217F268862C577CACF4E9F84C63E02B647113D484338A74EB0B24FADD6D87B4E7A551DD1EF692BB38E44562BFF848982ACB62840D4F49F91A7751320E34
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......d...........N......................................`............`A........................................m.w.......x.d....p........}..H....................w.......................w.(.....d.@.............x.......w.@....................text.....d.......d................. ..`.rdata..D.....d.......d.............@..@.data.........y.......y.............@....pdata...H....}..J....}.............@..@.gxfg....-...........d..............@..@.retplne.....@...........................tls....B....P......................@..._RDATA.......`......................@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Slax\resources.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):5755390
                                                                                                                                                                                                                  Entropy (8bit):7.996220000544904
                                                                                                                                                                                                                  Encrypted:true
                                                                                                                                                                                                                  SSDEEP:98304:JZ5ti6+nkrht455GGPeenn0mJSwLEpxIvMi8rwrGU3nAaqdkmYAzFKwR4:j7ilnkrP455GGHnhEXU8kr1Xqdf1FvG
                                                                                                                                                                                                                  MD5:6772B597BF68622D934F207570E771B1
                                                                                                                                                                                                                  SHA1:F2A80FBFA034CB1FA07DC9AA37BF9F5B2280FF13
                                                                                                                                                                                                                  SHA-256:268DE4D99AB7C4F4EE32C8E8CB2B058A2C8D0D839F468AE8E8C0605FEAA736EA
                                                                                                                                                                                                                  SHA-512:A2BE67DF09951C9EF9200DCCCBDFF13736921522191F0001DA539D5C7F26B5B26A6B810BE6963908F216768C98D21E52486C7E00538CC0730E8C78E78811B85B
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:............f..#..{.V...|.*1..~..4....OG....aI................V...........@..............................................D9....Dc....D.....D.....D.....D.....D,....D" ...D*$...D.$..HE.$..IE.(..JEx*..SE-/..TE.8..UE.G..VE.h..\E.q..]E.r..^E.s..`E*t..aEty..bE....cExo..dE.Z..eE.[...E.\...E.m...Eho...Exs...E.u...E.{...E.....E....E.....E.....E[....E....EV....E.....E.....E7....E.....E.....E2....E.....L9....L.....L.....L+....LP....L.....L(.../Lo...0L5...1L,)..2L.3...Q.D...Q.P...QdY...Q.\...Q._...Q.j...Q.k...Q.l...QAn...Q.....Q.....R.....R....ZdA&..[d"(..\d:=..]d.@..^dpA.._d3D..`d.G..adqI...d.T...d.Y...d._...d.m...d.p...dUu...d.v...d.x...d.y...d.|...d;....d....6eL...7e|...8e...9e5...:e....;e....<e....=e....>e#...?e....@eo...Ae....Be=...Cex....gp....ga0...g.2.....3.....6.....*....X+.....2.....2.....4.....9.....L....K...........a.....g.....9.....Y.................7... .>...<..L..=..M..>..S..?..X..@.cZ..B.]g..C..i..D..s..E..v..F..w..G.i...H.....I.....J.....K.]...L.....M.....N.S...O._...P.L...Q...

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ronea1e.aon.ps1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5pdlc52x.w03.psm1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ookrmsfv.nwr.ps1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tzokymh4.j5m.psm1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\LICENSE.electron.txt

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:ASCII text
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1096
                                                                                                                                                                                                                  Entropy (8bit):5.13006727705212
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                  MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                                                  SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                                                  SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                                                  SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\LICENSES.chromium.html

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:HTML document, ASCII text
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):9099045
                                                                                                                                                                                                                  Entropy (8bit):4.754770173605162
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24576:2o9dQ06p6j6j1WOwRiXjYmfy6k6mjK64jK6gjK6e6cjK6feGjl8PpE:BFOeGT
                                                                                                                                                                                                                  MD5:6FF57C0AECCDF44C39C95DEE9ECEA805
                                                                                                                                                                                                                  SHA1:C76669A1354067A1C3DDBC032E66C323286A8D43
                                                                                                                                                                                                                  SHA-256:0BA4C7B781E9F149195A23D3BE0F704945F858A581871A9FEDD353F12CE839CA
                                                                                                                                                                                                                  SHA-512:D6108E1D1D52AA3199FF051C7B951025DBF51C5CB18E8920304116DCEF567367ED682245900FDA3AD354C5D50AA5A3C4E6872570A839A3A55D3A9B7579BDFA24
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\Slax.exe

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):188703744
                                                                                                                                                                                                                  Entropy (8bit):6.7582799459614025
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:1572864:bwl41lgY+w9QLv1JWYc6UeOtUUGQUT1jdu4BPPuuwT2GOqiB1sr7zjg7ob753oUV:RF4oD0QdG09P
                                                                                                                                                                                                                  MD5:262797985453830673179336B6BACAC6
                                                                                                                                                                                                                  SHA1:E8AB15D4C8606CF1341F2CD7EF27F69145C0F372
                                                                                                                                                                                                                  SHA-256:663C85DDB2BDA40E449BFD73F2E13E8B5C007240266F1440DFC42ECE6E2D36CC
                                                                                                                                                                                                                  SHA-512:C95598F7DDC560AE9110201D354F61D8621EC8AF83E93E550DFE58B10C1DF0BE060ECDABAAB0CE4A2DCFC2B77152A044E3B824BEB4623958D388EC6A5C63D925
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."......FH.........`IY........@.............................p~...........`..........................................d..k...0...h....`m.H.....#...H..........0o..5..P.......................0...(....}H.@............................................text...*DH......FH................. ..`.rdata.......`H......LH.............@..@.data....H......L..................@....pdata....H...#...H.................@..@.gxfg....B...pl..D....-.............@..@.retplne......l......*...................rodata.......l......,.............. ..`.tls..........l......>..............@...CPADinfo8.....m......D..............@...LZMADEC.......m......F.............. ..`_RDATA.......0m......X..............@..@malloc_h.....@m......Z.............. ..`prot.........Pm......\..............@..@.rsrc...H....`m......^..............@..@.reloc...5...0o..6....0.............@..B................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\chrome_100_percent.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):151599
                                                                                                                                                                                                                  Entropy (8bit):7.915992368779121
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
                                                                                                                                                                                                                  MD5:83EC43F2AF9FC52025F3F807B185D424
                                                                                                                                                                                                                  SHA1:EA432F7571D89DD43A76D260CB5853CADA253AA0
                                                                                                                                                                                                                  SHA-256:A659EE9EB38636F85F5336587C578FB29740D3EFFAFF9B92852C8A210E92978C
                                                                                                                                                                                                                  SHA-512:6DDCA85215BF6F7F9B17C5D52BD7395702515BC2354A8CD8FA6C1CCD7355A23B17828853CEABEEF597B5BCA11750DC7C9F6EC3C45A33C2106F816FEC74963D86
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:..........<.............h.....i.\...j.....k.I...l.....n.....o.....p.:...q.4...r.o...s.?...t..!..u..%..v.@'..w..1..x..<..y.l?..z..C..{..G..|..I..}..J..~..M.....O.....R....|V.....Z.....]....N`.....a....3c....gd.....e....@g.....g.....m....~s....Fw....&{.....~..........*.....m................8..........._...........1....V.............w....e........F.........'....Z....k....5...,.....-.h........./.....0.!...1.....6.f...7.....8..!....$....&...../.....1.....5....3:....CE.....F....(O.....U....b[.....`....g....^i.....m.....q....V{....v~..............R...............X.....#.................................................|.....S..........W...........i..........2.....`...........S...........S.....(............................s...........y.....N.....".......................&.............................................Q"....-#.....#....$....v%....?&.....&....*(.... ).....*...........2....33....3.....3.....4....5....v6.....6.....7....f7....7.....7.....>.....A....sB

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\chrome_200_percent.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):228644
                                                                                                                                                                                                                  Entropy (8bit):7.946488830213853
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
                                                                                                                                                                                                                  MD5:DC48A33BD20BFC7CACFC925A84B015B6
                                                                                                                                                                                                                  SHA1:8DFEE88FD1DC77F89AD88C19146FE3AB45E43F3C
                                                                                                                                                                                                                  SHA-256:2C1B3E4B8A0CF837AE0A390FCA54F45D7D22418E040F1DFEA979622383ACCED6
                                                                                                                                                                                                                  SHA-512:1D54EB5D2BA06AF0BA8F6B491B0D43F178A48AC82CDF383BEB265E732DDFC06BCA9692003FDFCE56F7F00AF97F29ACF046C73B891B8C561610098F9626EAF05A
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:..........<.........&...h.....i.....j.....k.....l.....n.....o.|%..p..*..q..-..r.85..s..:..t..>..u.CG..v..K..w.._..x._t..y.{y..z....{.4...|....}.m...~...............................................h.............................5.................t...........-.................D............$.....-....K9.....@....FH...bL...9O...nT...)U...jV...UZ....]...s`...xc...f....j...n..,.\r..-..s....ku../..v..0..w..1.Dx..6..x..7.....8.Q............................F................S..........{...........^.....@...........!....%....&/....R2....:....>....RH....R.....V....|X....Sa.....i....k.....n.....r.....y.....{....%..........`.....7...........................................0.....I..........;.....l.....b.....B.....%.....S.....m..........L...........R..........V...........g.....)........................!.....'....-....u3.....4.....5.....6.....8....:9.....:.....<....=....`?....$L.....\....v\.....\....;].....]....._....._....K`....`.....a....]a....a.....g.....k....Rl

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\d3dcompiler_47.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):4916728
                                                                                                                                                                                                                  Entropy (8bit):6.398031738914566
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
                                                                                                                                                                                                                  MD5:A7B7470C347F84365FFE1B2072B4F95C
                                                                                                                                                                                                                  SHA1:57A96F6FB326BA65B7F7016242132B3F9464C7A3
                                                                                                                                                                                                                  SHA-256:AF7B99BE1B8770C0E4D18E43B04E81D11BDEB667FA6B07ADE7A88F4C5676BF9A
                                                                                                                                                                                                                  SHA-512:83391A219631F750499FD9642D59EC80FB377C378997B302D10762E83325551BB97C1086B181FFF0521B1CA933E518EAB71A44A3578A23691F215EBB1DCE463D
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K......JK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\ffmpeg.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):2929152
                                                                                                                                                                                                                  Entropy (8bit):6.70454100720416
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:49152:ZBAnytEwrZu/3Q8rvnh2UGH6qfhtvRIdefZiC6Cry2:ZBFE6kfbrvnh21K+io
                                                                                                                                                                                                                  MD5:5A168CB3EA9D0E7400BAABF60F6AB933
                                                                                                                                                                                                                  SHA1:82A86CB7F42294AB4AD6669C19B92605D960B676
                                                                                                                                                                                                                  SHA-256:AF5F1BC9F6A73750FA0C7BF17439700CFB3AB23E1393F0C9899825417E319B54
                                                                                                                                                                                                                  SHA-512:7C1441ECD049543E38297A7B6929E9F3EB978422D0CE508FBE6350FFEBD297F947B8D9EC75BD2054142DCD8461EEF1BF110E040D0830DA977FDE8944BECE843D
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......#...................................................:...........`A..........................................*.......*.(.............9..............:.<5....*.......................*.(.....$.@...........H.*.8............................text.....#.......#................. ..`.rdata........$.......#.............@..@.data.........+.."....+.............@....pdata.......9.......+.............@..@.gxfg....+...0:..,...J,.............@..@.retplne.....`:......v,..................tls.........p:......x,.............@..._RDATA........:......z,.............@..@.reloc..<5....:..6...|,.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\icudtl.dat

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):10468208
                                                                                                                                                                                                                  Entropy (8bit):6.265606239082294
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
                                                                                                                                                                                                                  MD5:FFD67C1E24CB35DC109A24024B1BA7EC
                                                                                                                                                                                                                  SHA1:99F545BC396878C7A53E98A79017D9531AF7C1F5
                                                                                                                                                                                                                  SHA-256:9AE98C06CBB0EA43C5CD6B5725310C008C65E46072421A1118CB88E1DE9A8B92
                                                                                                                                                                                                                  SHA-512:E1A865E685D2D3BACD0916D4238A79462519D887FEB273A251120BB6AF2B4481D025F3B21CE9A1A95A49371A0AA3ECF072175BA756974E831DBFDE1F0FEAEB79
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E...(...E...)...F...).."F...1..5F..`1..EF...N..XF..PN..hF...N..xF.......F.......F.......F..@....F.......F......F..0....F.......G......$G......7G......JG......]G..@...pG.......G.......G..@....G.......G.......G..@....G.......G..p....H..`....H.......H..@...AH......TH..p...gH.....zH.......H..`....H.......H.......H..P....H.......H......H..`....I......%I..P...:I......RI.....bI..@...uI.......I.......I.......I..P....I.......I.......I..0....I.......J... ...J.. !..-J..@$..=J...$..PJ...$..qJ.......J...<...J....&..J....&..J.. .&..J....&..K..`.&..K....&.3K....&.JK..0.&.aK....'.xK....'..K....'..K...(..K....(..K...O)..K....)..L..0Q*.>L..`.*.gL..Pi+..L....+..L...i,..L....,..L..P}-..M..@.-.,M.. .-.EM....-.\M....-.uM....-..M...$...M..0%...M....0..M...j0..M..`.0..N..p.0.1N....0.AN....0.TN..@.0.iN....0..N..0.0..N....0..N....0..N....1..N....1..N..

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\libEGL.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):493056
                                                                                                                                                                                                                  Entropy (8bit):6.3672588781107775
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:0PfRujpqWG9btH+M1wLPfj9iDcHetGsHUN0dxI2H6sNkD4Fvh2W:eAWt+MWLPfjkVGbN0dxI2H63D4Bh2
                                                                                                                                                                                                                  MD5:39CCF402A62F068A8C573B45EA96154D
                                                                                                                                                                                                                  SHA1:57CEB915EA6F88C7FCCA35339BF951659C0338AB
                                                                                                                                                                                                                  SHA-256:8649D77ACE8E5753B9A10E7AE3349AAFA9D8E3406BA9C8C36A59633A84B3C41B
                                                                                                                                                                                                                  SHA-512:C4F9225C54D413176CB3DD2B26D429493FD056C7C283BC7A1C52B4A2059DBB11380DAF5D847BE1FF29F058BA0EF44D4BF66A3D9E9A600000DC8F6D20DFB2ED03
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .....l................................................................`A.........................................l......h{..(.......x....P..l?..............<....d.......................c..(.......@...........p~...............................text....k.......l.................. ..`.rdata..lr.......t...p..............@..@.data....K....... ..................@....pdata..l?...P...@..................@..@.gxfg... &.......(...D..............@..@.retplne.............l...................tls....!............n..............@..._RDATA...............p..............@..@.rsrc...x............r..............@..@.reloc..<............x..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\libGLESv2.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):8418304
                                                                                                                                                                                                                  Entropy (8bit):6.508090684401189
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:98304:Q7XpFwEPVsR+1HYJnahAB4tVsX43wYMg:QXVrAtsw
                                                                                                                                                                                                                  MD5:F055A130C79BD517BDB53B1F8A38BD3B
                                                                                                                                                                                                                  SHA1:9FBA0AD4BA973BB285B23CC125004BAF61A98B5A
                                                                                                                                                                                                                  SHA-256:45B53759392B81CE7D916B3F1CF02BE30289809BD31D09FC1524EF2609183B17
                                                                                                                                                                                                                  SHA-512:D9DCB217F268862C577CACF4E9F84C63E02B647113D484338A74EB0B24FADD6D87B4E7A551DD1EF692BB38E44562BFF848982ACB62840D4F49F91A7751320E34
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......d...........N......................................`............`A........................................m.w.......x.d....p........}..H....................w.......................w.(.....d.@.............x.......w.@....................text.....d.......d................. ..`.rdata..D.....d.......d.............@..@.data.........y.......y.............@....pdata...H....}..J....}.............@..@.gxfg....-...........d..............@..@.retplne.....@...........................tls....B....P......................@..._RDATA.......`......................@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\af.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):533447
                                                                                                                                                                                                                  Entropy (8bit):5.412080848029905
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:WEGL+ocurcdy6VGycsaja+H2Jyngae5Ig1eo0vMIlgL2pQ+FXZG2vt2pslFd5/51:W1+ozrc86VZBaja+H2Jyngae5Ig1eo0N
                                                                                                                                                                                                                  MD5:D9BEC09B6C523DC3BCA9A81264B1BEED
                                                                                                                                                                                                                  SHA1:EA4AE9DFF554C59994632F85AF25B36C049FB5B2
                                                                                                                                                                                                                  SHA-256:0B5A45DE223CE8522CC296AF1E93477540EAA74867428307CC3A5CD21921B022
                                                                                                                                                                                                                  SHA-512:6E7677F86F73EDFFB5D6162CA19BB7464465F0F485CE2971FB20AD3F57D9FAC56B7A21D378701F80E85FB185C3AF6A238F8C8707F5874BFFFFD79D881A54DD6E
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.)...l.4...n.<...o.A...p.N...q.T...r.`...s.....t.....v.....w.....y.....z.\...|.....}.........................................................................#.....2.....C.....V...........A.......................c.........................................M.......................F.......................!.....o.......................c.................$.....y.................0.......................,.......................7 ..... ..... ..... ....h!.....!....."....1"....."....."....."....."....E#.....#.....#.....#.....$....@$...._$....h$.....$.....%....L%....[%.....%.....&....B&....R&.....&.....&.....'.....'....n'.....'.....'.....'....7(.....(.....(.....(....1).....).....).....)....Q*.....*.....*.....*....1+....s+.....+.....+.....,....U,....z,.....,.....-....]-.....-.....-....*.....h.......................I/....u/...../...../....A0....|0.....0....#1.....1.....1.....2....}2.....2.....3....=3.....3.....4....54....H4.....4.....4.....4.....5....e5.....5.....5

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\am.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):861015
                                                                                                                                                                                                                  Entropy (8bit):4.906916579483596
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24576:HzD984ToH3hTCNRysrxQH9hjN3Rpzvh51muMXqVFq+XG/6WxLP5A:qn5N
                                                                                                                                                                                                                  MD5:E3933DE22DC7FB98215B083D8A379F40
                                                                                                                                                                                                                  SHA1:68DDBD9BCC931F0D4A172FA65AF35B823C7C9E37
                                                                                                                                                                                                                  SHA-256:EAA747075E5A62BE8B7DF5908E167CCC5314C9C6A8B890059D00284A3C496FEF
                                                                                                                                                                                                                  SHA-512:7BEB80FA029F41CB21536B15C604E2AE9DFC20B4A3EC4F5CC04E2B105D4B2C251830624957197084761F9686F95D332E25D4F6178509AD58257AF90D96A9E7D5
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.%...j.1...k.@...l.K...n.S...o.X...p.e...q.k...r.w...s.....t.....v.....w.....y.E...z.s...|.....}.................................................&.....'.....(.....-.....I....._.......................`...................................6.................S...........E...........P.................x.................S ..... .....!.....!.....!....P".....".....".....#....^$.....$.....$.....%.....&....c&.....&.....'.....'.....(....A(.....(....{).....).....).....*.....+.....,....H,.....,.....-....C-....v-.....-....N................../....w/...../...../....u0.....1....y1.....1....@2.....2....03....F3.....3....c4.....4.....4...._5.....5....16....P6.....6....T7.....7.....7....`8.....9.....9.....9....0:.....:.....:.....;.....;.....;....6<....^<.....<....c=.....=.....=....{>.....>....b?.....?....*@.....@.....@.....@.....A.....B....RB....qB....,C.....C.....D....7D.....E.....E....TF....nF....9G.....G....NH.....H....LI.....I....`J.....J.....J....FK....lK.....K....8L.....L....6M

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\ar.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):943328
                                                                                                                                                                                                                  Entropy (8bit):4.930661249056055
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:NYI8HRnwBUC/+/RYfESugvPUB6m7kOCSn5KNp5QpnSKU/:SNHRnh5aQM
                                                                                                                                                                                                                  MD5:AC865FF462F341B4317C3D16EEB40460
                                                                                                                                                                                                                  SHA1:1E971D97F09884B23595F17534227EA43CF99090
                                                                                                                                                                                                                  SHA-256:0557BC17EB1D134BD52F203836551B55579114708E2DF51F653972951567513D
                                                                                                                                                                                                                  SHA-512:A935B91A2C053303E941866CFC151F28053FAF364AEECE98D61FCD68FEF6C6F1D3B73DE01CD602C8A4A081CCE452D1CE87F8166BA3C0E8B81E91D932F84737F2
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........j(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.&...t.=...v.r...w.....y.....z.....|.....}.K.....t.....y.......................................................................L.....@.....#....................... .....|...........H...........m...........?...........L.....}.............................k............ ....) ..... ....a!.....!.....!....."....\#.....#.....#.....$.....%.... &....Q&.....&.....'.....'.....(.....(....l).....).....).....+.....+.....,.....,....p-.....-..........Y...........B/....u/...../.....0.....0.....0.....0.....1....Z2.....2.....2....h3.....3....,4....=4.....4....w5.....5.....5....q6.....6....57....L7.....7....W8.....8.....8....F9.....9....H:....e:.....:....d;.....;.....;....K<.....<.....<.....=....L>.....>.....>....U?.....?.....@....a@.....@....9A....\A....yA.....B.....B.....B.....C.....C.....C....KD....dD....lE....MF.....G.....G.....G....mH.....H.....H.....I.....J....EJ....\J.....J....%K....KK...._K.....L.....L....&M....HM.....M

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\bg.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):982837
                                                                                                                                                                                                                  Entropy (8bit):4.669923863173967
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24576:MhQgWoOYLYyzQkECvUPVbKDks373ZAW3AAK1mVDLpv74umpjd2SI5IxuFsoGQXxQ:VgWoOYLYfYUPVbKDks373ZN3ApmVDLpw
                                                                                                                                                                                                                  MD5:7C37C8C9B4215089B6C16D22838D256B
                                                                                                                                                                                                                  SHA1:8F2AFDC21353685353A0562452F4A79180E58829
                                                                                                                                                                                                                  SHA-256:2EBD582DFAA3139CD6A03E9892A94A3D9BB6936E0B04085B8F2D27E1DEC0BC8A
                                                                                                                                                                                                                  SHA-512:BEADD70E9D706576BFB6725617385F776E9F68C84D116B01187354D377E2C860899DA34F8C5A054C4BDE41A57E9AAC56445F6AC0B8DA8C75A424641A86FDD718
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i."...j.....k.=...l.H...n.P...o.U...p.b...q.h...r.t...s.....t.....v.....w.....y.B...z.p...|.....}.................................................#.....$.....%.....*.....L.....e.............................$.....U.................9.....c...........p...........Z.....P.......................r ..... ....F!....l!.....".....".....".....#.....#.....$.....%....b%....^&.... '.....'.....'.....(.....)...."*....X*.... +.....+....5,...._,....K-......................./.....0....N1.....1....C2.....2.....3....)3.....3....\4.....4.....4....z5.....6....J6....p6....'7.....7.....8....E8.....8....n9.....9.....9....l:.....:....0;....P;.....;....a<.....<.....<....n=.....=....J>....r>....m?....S@.....@....-A.....A....^B.....B.....B...._C.....C.....D....gD....CE.....E....^F.....F.....G....3H.....H.....I.....I....NJ.....J.....J.....K....(L.....L.....L.....M....8N.....N.....N.....O.....P....XQ.....Q....}R....7S.....S.....S.....T....dU.....U.....U.....V.... W....kW.....W.....X....dY.....Y

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\bn.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1267393
                                                                                                                                                                                                                  Entropy (8bit):4.284356072775859
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:LEcoGqGB2le1abaCb6Ew/0WySZIS+xd2f/MHDrYfHBpxspSPrCXqB+iBbHRI8T51:LjJfa56/0z5XpCOXqB+iBbD5YqNn
                                                                                                                                                                                                                  MD5:FC66ADF3DEAC72FD39105540DD2DAEFF
                                                                                                                                                                                                                  SHA1:A53B54EFCC1285A226D605116F87D12F69942482
                                                                                                                                                                                                                  SHA-256:EF50CFEBAF9E32EDEEC25D30197AC5899B3DB8A0676671F639D32BC48F3B3BD8
                                                                                                                                                                                                                  SHA-512:0B77DAA056451D01A8CFB3FF1ACC08D34E64E0A32BB119C8837AE3D6E3D5195311427C6101EFD7E7BC9104AA369832BB12AAB3D4080C00DC39EDC98B6C0B949E
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.....l.#...n.+...o.1...p.>...q.D...r.P...s.....t.....v.....w.....y.....z.L...|.s...}...............................................................................0.....U.....................................................?.......................Z.................. ..... ....(!.....!.....".....#....N#.....$.....$.....%....+%....R&....0'.....'.....(.....).....)....^*.....*.....+....~,.....-....1-.....-.........../....E/....@0....*1.....1.....1.....3.....4.....4.....5.....5....k6.....6.....6.....7.....8....`8.....8.....9.....9.....9.....:.....:.....;.....;....:<.....<.....=.....=.... >.....>....{?.....?.....?.....@....9A.....A.....A....XB.....B....LC....rC.....D.....E....{F.....F.....G.....H.....I....QI.....I....sJ.....J.....J.....K....iL.....L.....M.....M.....N....^O.....O.....P....#Q....oQ.....Q.....R....5S.....S.....S.....T....{U....#V....\V.....W.....X.....Y.....Z....@[....B\.....\....L].....^.....^....W_....._....]`....$a.....a.....a.....b.....c

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\ca.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):598934
                                                                                                                                                                                                                  Entropy (8bit):5.408962543645936
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:gVHfWsqPdf9nwWF47D1MeCi24b3Fe5PFFuN3Mw2juwHzejm0t3l3kb7TenzL8wOs:gV/WRdlnPyToiL6YhgMNxgCh5cxSas
                                                                                                                                                                                                                  MD5:E1AC7F4C28177F68FAC3BE2375A9368C
                                                                                                                                                                                                                  SHA1:3D7738699087468A748F9B1189D2F7621187D03B
                                                                                                                                                                                                                  SHA-256:EFA1BA906F8ABCE91EBB9D6442B64E0D5AE7DAB78DDA8A49A6FED1A342C71B9B
                                                                                                                                                                                                                  SHA-512:AEE8CB28EB02E2FB2155C8D093CF678284E3571F46B913F743DE3C6D0215C18B80866FF446F46ADA160860ED9C18AE9A4209424E7E0F0BA97C78A3FE9815CA5A
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.!...l.,...n.4...o.9...p.F...q.L...r.X...s.....t.....v.....w.....y.&...z.T...|.{...}.........................................................................%.....>.....^.....|.......................7.................S.....l.............................m.......................v.......................k...................................2.....`...........R.................- ..... ..... ..... ....I!.....!.....!.....!....c".....".....#....,#.....#....L$.....$.....$....3%.....%.....%.....%.....&....i&.....&.....&.....&....N'....{'.....'.....'....\(.....(.....(.....)....b).....).....).....)....H*....s*.....*.....*.....+....I+....V+.....+.....,....A,....R,.....,....D-.....-.....-..........\................../....L/....o/...../.....0....S0....h0.....0....N1.....1.....1....+2....r2.....2.....2.....3....^3.....3.....3.....4....c4.....4.....4....b5.....5....\6....w6.....6....c7.....7.....7....I8.....8.....8.....8....@9.....9.....9.....9....9:.....:.....:.....:

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\cs.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):616994
                                                                                                                                                                                                                  Entropy (8bit):5.843791316218894
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:863oqX0hmR4QkWA9jN85ASh6mARAO52C+wH/NOKbJSBXR8QQ:VYPNB85AS0P52C+wH/NOeJS+
                                                                                                                                                                                                                  MD5:92E3FD1EB47767A0CB5F6E734DE4EEC1
                                                                                                                                                                                                                  SHA1:33053BFEAD1FA67160B6A3C417EC4559BFDCDCFB
                                                                                                                                                                                                                  SHA-256:D269E16FBD9B2AFE95B148ECE22B2AC803768FB53EE42E1FAD0181F9DEC84544
                                                                                                                                                                                                                  SHA-512:916D73D9B28B0600878418A06388C2ED61BFAF17807A16E1C157A30E5DA136C6B6F194E99D151C43B9AA35D101DE755CAA6DA69E1C8A50DD134F27A7F2ADC016
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.....l.....n.....o.....p.&...q.,...r.8...s.g...t.~...v.....w.....y.....z.4...|.[...}...........................................................................................4...........^.................<.......................i...........A.....Z...........?.....{.................U.......................D.....l.................T.................:.................+............ ....K ....c ..... ....6!....k!....{!.....!....k"....."....."....:#.....#.....#.....$....u$.....$.....$.....$....N%.....%.....%.....%..../&.....&.....&.....&.....'.....'.....'.....'....2(.....(.....(.....(....-).....).....).....)...."*.....*.....*.....*....:+.....+.....+.....+....f,.....,....)-....@-.....-.....-.....-..........Q.......................W/...../...../...../....]0.....0.....1....I1.....1.....1.....2.....2.....2.....3....13....F3.....3.... 4....a4....y4.....4....g5.....5.....5....E6.....6.....7....77.....7.....8....D8....Y8.....8.....9....49....H9.....9....":....\:

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\da.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):558889
                                                                                                                                                                                                                  Entropy (8bit):5.449151445338137
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:Gqv1aOSLABh3359zVmh5OsfZh1seDrwwlQJWJwgIobwmPaHL95bpkUdRi3jd4xFm:GqonsMfPrWb55bpfddm
                                                                                                                                                                                                                  MD5:43029018648D558F9BBF7A74C59EB281
                                                                                                                                                                                                                  SHA1:90C6618CCCB4DB85D7485AE8D809EC3AF4763E70
                                                                                                                                                                                                                  SHA-256:4BD88F6AB82842358987AAD384775B35198DD75C2CCE4CAE783208ED69296A7E
                                                                                                                                                                                                                  SHA-512:9E8EF9D4367AD01F2F4E7DD6F9884E463729EE5A0F678FD16A3CE093C21EFC1D78041D5C6E45037F37BFD732E4833744485B00ACFDA2313A1D1E947993129A3D
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.+...j.7...k.F...l.Q...n.Y...o.^...p.k...q.q...r.}...s.....t.....v.....w.$...y.K...z.y...|.....}...........................................%.....,.....-...........0.....>.....N.....b.....{...........`.................!.......................l...........A.....]...........-.....].....q........... .....G.....T.................2.....@.................8.....R...........>.....z.................w.................. ..... ..... ..... ....l!.....!....@"....Z"....."....s#.....#.....#....A$.....$.....$.....$....(%.....%.....%.....%.....&....Z&....~&.....&.....&....R'.....'.....'.....'....W(.....(.....(.....(....K)....v).....).....)....**....P*....Z*.....*.....+....@+....N+.....+....I,.....,.....,.....-...._-.....-.....-.....-....<.....Z.....r............/....6/....F/...../.....0....h0.....0.....0....W1....|1.....1.....1....b2.....2.....2.....3....T3.....3.....3.....4.....4.....4.....4....q5.....5.....6....N6.....6.....7....J7....\7.....7.....7.....8.....8.....8.....8.....9

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\de.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):596603
                                                                                                                                                                                                                  Entropy (8bit):5.5059525736264
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:55U5D5aDs3K7UpGg5aL9Xtt5fPMkUz1CTz:5eaDs3K7UpGg5aLRf53MtCTz
                                                                                                                                                                                                                  MD5:3A8DE004B3A610271E1D1913B6D4B53B
                                                                                                                                                                                                                  SHA1:236893C3F7B450E6AD8B4D54E1A62B2E635B42D6
                                                                                                                                                                                                                  SHA-256:43C060182C92CAF4AEBF8FD7B913DFE017BEEA71E796E862EBF8746575948364
                                                                                                                                                                                                                  SHA-512:B70F849CCF7DD9E72D71522591420E0BAA03FF74763B44563B0B3800BA3A88CB8B973FABB90BBB6653819947ECA47F70E347958E3C31AB226957F7313BC03554
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........((C.e.....h.....i.'...j.3...k.B...l.M...n.U...o.Z...p.g...q.m...r.y...s.....t.....v.....w. ...y.G...z.u...|.....}...........................................!.....(.....).....*.....,.....=.....P.....b.....x.....2...........J....._...........b.................?...................................?.....W...........B.....p.................k.................:.............................'.....c............ ..... ..... ..... ....O!.....!....."....#"....."....O#.....#.....#....]$.....$....Q%....p%.....%....O&....q&.....&.....&....^'.....'.....'.....(....p(.....(.....(....1).....).....).....*.....*.....+....7+....G+.....+.....,....a,....r,.....,....W-.....-.....-............................j/.....0....W0....m0.....0....J1....l1.....1.....1....62....S2....f2.....2....93....b3....u3.....4.....4.....4.....4...._5.....5.....5.....5....q6.....6.....7.... 7.....7.....8....X8....n8.....8....|9.....9.....9....i:.....:....);....V;.....;....?<....l<.....<.....<....U=....~=.....=.....>.....>.....>

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\el.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1076241
                                                                                                                                                                                                                  Entropy (8bit):4.759988949622547
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24576:yvHcaFbu4FDYX9QCMDhWJXDsS7miHk3D2NpYRDojvmXgVT8y2IWYNQKlCt2rDQur:aHcaFbu4FDYX9QCMDhWJXDsS7miHcD2r
                                                                                                                                                                                                                  MD5:58D6EAF71B9B73F5F7F057C73D0D92EC
                                                                                                                                                                                                                  SHA1:16E0587753E7D2834F4CBB24FED45E7BD2F8F2F4
                                                                                                                                                                                                                  SHA-256:8474879DE21C414D34C44CF0A8C91356A66DBD647308A4F994BE25BD1F93A89F
                                                                                                                                                                                                                  SHA-512:AB24C9655BD68E4A64E257914A35DC84B5F791C58B396AE004BF5DA61DF19C02EF9CA572B8E63F15BAF3694AE1E540ADF74586F10D28D7EF90EDEEC982BCF28D
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.....l.(...n.0...o.5...p.B...q.H...r.T...s.....t.....v.....w.....y."...z.P...|.w...}...............................................................................S...........................................................T.....\.....0.................1...........F ..... ....C!.....!....)"....J"....."....~#.....#.....#.....$.....%.....%.....&.....'.....(.....(.....(.....)....t*.....*.....+.....+.....,....'-....R-....C............/...../.....0.....1.....2.....2....~3..../4....{4.....4....R5.....6....H6....m6.....7.....7.....8....<8.....9.....9....]:.....:....Q;.....<.....<.....<....y=....O>.....>.....>.....?....Y@.....@.....@.....A....QB.....B.....B.....C.....D....wE.....E....|F....DG.....G.....G....}H.....I....<I....XI.....J.....J.....K....0K.....L.....L....YM.....M....VN.....O....<O....cO.....P.....P....NQ.....Q....kR.....S.....S.....S.....T.....V.....V.....W.....X.....X....dY.....Y.....Z.....[....7\....h\....#].....]....W^....y^....._....z`.....`

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\en-GB.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):485863
                                                                                                                                                                                                                  Entropy (8bit):5.521699894815275
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:Ll+Npdwk8sj7ahcbKdFk+ufMP9ezQSKrfaYdrcLlY5IPxZBcvRJ+G:Ll++143fMuQSK3Z5MxLG
                                                                                                                                                                                                                  MD5:985558DE03BF486AEC1DAADD39CB508D
                                                                                                                                                                                                                  SHA1:B693DDEF983E8AF212936202DDCA92D908378404
                                                                                                                                                                                                                  SHA-256:1956D448A4D333638F3601D0DA976710CBE0A795504EB694BA18311FE586D195
                                                                                                                                                                                                                  SHA-512:13D1C82B797AD4FF25A94A996F9FB52B530643A0E735F96E32B9E0698962770148D95DB7BEB91343D781FB84378A3E334AC0C1C913D8DBAE20F425BF0DC364D3
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........)d.e.....h.....i.....j.....k.....l.....n.....o.....p."...q.(...r.4...s.c...t.z...v.....w.....y.....z.0...|.W...}...........................................................................................'.................E.....Y.......................>.................:.....P.................$.....9.............................K.............................Y.....~.................L.......................:.....k.....y.................;.....K.................. ..... ..... ..... ....!!....5!....t!.....!.....!.....!....."....N"....m"....w".....".....".....#....##....}#.....#.....#.....$....^$.....$.....$.....$....)%....n%.....%.....%.....%.....&....V&....a&.....&.....&.....'....#'.....'.....'.....(.....(....|(.....(.....(.....(....>)....z).....).....).....)....>*...._*....n*.....*.....+....G+....m+.....+.....+.....,.....,....q,.....,.....,.....,....`-.....-.....-.....-....[............/...../...../...../.....0....-0.....0.....0.....0.....1....Q1.....1.....1.....1.... 2....m2.....2

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\en-US.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):490357
                                                                                                                                                                                                                  Entropy (8bit):5.513411409378336
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:1kdXRDCwszpReMP9e0QcD2faYjNCu454ZxDng/t/XFLwB:1sUwGeM1QcDq+5UxOLwB
                                                                                                                                                                                                                  MD5:752A3FEED3AB6C127767C8FABC9A40B6
                                                                                                                                                                                                                  SHA1:4AF9F9C19904D3BEF154B469858DC44B1E630A75
                                                                                                                                                                                                                  SHA-256:C6A6C5D7AB6119BBA712D6FE45FD385506D4D0DD8E4156CCA3925062F4502AC5
                                                                                                                                                                                                                  SHA-512:AE96D4F391E36F8F741671B72EBD4B1AB2D049B2A99B95737FB9F81743B9E414B46022B65194AF5616EB354056ADDF0E46EF090F56B7D945EF2CB5F4D100D64F
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........O)..e.\...h.d...i.l...j.x...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.9...w.e...y.....z.....|.....}.......;.....@.....H.....P.....X....._.....f.....m.....n.....o.....t.............................#.......................;.......................0.......................3.....~.......................S.....|.......................=.....J.............................z.......................l.......................H........................ ....^ ..... ..... .....!....^!.....!.....!.....!....*"....E"....T"....."....."....."....."....8#....u#.....#.....#.....#....J$....|$.....$.....$....&%....S%...._%.....%.....%.....&....!&....i&.....&.....&.....&....)'....n'.....'.....'.....(....](.....(.....(.....(....=)....`)....v).....).....).....*....1*.....*.....*.....*.....*....P+.....+.....+.....+....7,....n,.....,.....,.....,....7-....a-....q-.....-..........N.....f...........7/...../...../...../....J0.....0.....0.....0....@1....l1....{1.....1.....2...."2....22.....2.....2.....3

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\es-419.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):589663
                                                                                                                                                                                                                  Entropy (8bit):5.378608358697393
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:cv+c/pQ8eguGEy1mVpDYl7G8oZOZ5zazaQ+ax891:cP3RsJpuGS5za9+D1
                                                                                                                                                                                                                  MD5:85E9B056E3AC3F6A5B113ED9F460E202
                                                                                                                                                                                                                  SHA1:DCCEEF6EA85D71A85DD24D17EC65371DCE76F480
                                                                                                                                                                                                                  SHA-256:16FE83762ED578C49685868418325920A72CD457907BC4E5264F2C172D53B27B
                                                                                                                                                                                                                  SHA-512:E4DFDE9C1260DF1F77B7EC1797658F8CFEAAB98142A8D512ED3BFAC054933A4583F20091B97985B4BA9CF93F9FACA3E7B0986CB4A3EB12FE0BC04EE1C45D3E0F
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.?...z.m...|.....}................................................. .....!.....".....$.....6.....E.....Z.....q.......................$.................A.....Y...........i.................`.................2.............................r...................................H.....x...........n.................P ..... .....!.....!.....!.....!....'"....>"....."....*#....r#.....#....%$.....$.....$....$%....v%.....%.....%.....&....[&.....&.....&.....&....R'.....'.....'.....'....l(.....(.....)....0).....).....)....2*....>*.....*.....*.....+....&+....x+.....+.....+.....,....p,.....,.....-....'-.....-..........f.................A/....p/...../...../....C0....j0.....0....41....j1....z1.....2....o2.....2.....2...._3.....3.....3.....3....U4.....4.....4.....4....y5.....5.....6.....6.....6....C7.....7.....7....N8.....8.....9....;9.....9....!:....e:....y:.....:.....;....5;....H;.....;....9<.....<.....<

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\es.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):589284
                                                                                                                                                                                                                  Entropy (8bit):5.3587509940363995
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:Uxb0Q3M9BnWhau1WK4G0gkjqpT+ZbBQihXFijs5J+f2D//z/h6PZOkx:SAwx4Lep4BQiXijs5k2r/Lzk
                                                                                                                                                                                                                  MD5:3DB06EA954C83343BD333C15947F521A
                                                                                                                                                                                                                  SHA1:DDDE6AB9F9085E83EC8BF7A37DF3389040ACEA42
                                                                                                                                                                                                                  SHA-256:45DF7340FE3C8560B11FFBA2219DE1B5C45DBFE57B6DB90BD6C246244FAE338A
                                                                                                                                                                                                                  SHA-512:CC29F1075C119DADDAA108C17ABB6D572925CAC1ED2237ED2FD45364BFB2A00C1144FCCDD22C6728C954AF2CDD1B9477F39968BA25354BCA2B9DCA07F5C53DDE
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h."...i.*...j.6...k.E...l.P...n.X...o.]...p.j...q.p...r.|...s.....t.....v.....w.#...y.J...z.x...|.....}...........................................$.....+.....,.....-...../.....B.....R.....g.............................2.................Z.....p.............................}...........).....D.......................>.................(.....9...........3.....x...........'.......................k ..... .....!....*!.....!.....!....6"....K"....."....?#.....#.....#....7$.....$.....$.... %.....%.....%.....&.....&....t&.....&.....&.....'....f'.....'.....'.....(.....(.....(.....)....")....{).....).....*.....*....k*.....*.....*.....+....R+.....+.....+.....+....I,.....,.....,.....,....X-.....-............................./....-/...../...../.....0....$0.....0.....1....01....C1.....1....82.....2.....2.....3....i3.....3.....3.....4....g4.....4.....4....'5....w5.....5.....5....m6.....6....Q7....h7.....7....u8.....8.....8....g9.....9.....:....%:....w:.....:.....:.....;....l;.....;.....<

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\et.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):536344
                                                                                                                                                                                                                  Entropy (8bit):5.456021867812121
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:HeaF27VNhXV9R5OJs99Z0+I+eL40dmFZxEYTHbtiPSia6OSt75H50MHsjiCKM2a6:HhFEVN53Q6Z8+wmFZq0SfH50MIW
                                                                                                                                                                                                                  MD5:8E2C2CC8C516D8B7181C0C712CA24513
                                                                                                                                                                                                                  SHA1:E0CCD9ED8DE6640379F822A067DCF97D4BBE44A7
                                                                                                                                                                                                                  SHA-256:C96937F46FB1B1182B201F5C48FE1DA4D3F94A68A0E6E0699CCC0944CD0A5A33
                                                                                                                                                                                                                  SHA-512:339BC655F22068F2EE9352A670325865265E4279197430214F7E3FBA575415318110CCCB03AED2C0E7AC673D4629BD495DC34A56CEFBCAAB62E1C4A1A87ED8C2
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.2...h.:...i.K...j.W...k.f...l.q...n.y...o.~...p.....q.....r.....s.....t.....v.....w.D...y.k...z.....|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P.....`.....r...................................$.................#.....6.................U.....k...........4.....d.....v...........,.....Y.....d.................F.....Y.................C.....a...........?.....z.................^.......................f ..... ..... .....!....r!.....!.....!....7".....".....".....#....p#.....#.....#.....$....^$.....$.....$.....$....>%.....%.....%.....%....6&.....&.....&.....&....B'.....'.....'.....'....L(.....(.....(.....(....C).....).....).....)....C*.....*.....*.....*....\+.....+.....,....&,....y,.....,.....,.....-....j-.....-.....-..........d................../....f/...../...../....(0....t0.....0.....0.....0....Y1.....1.....1.....1....g2.....2.....2.....3.....3.....4....f4....z4.....5.....5.....5.....5....Z6.....6.....6.....7....\7.....7.....7.....7....>8.....8.....8

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\fa.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):876080
                                                                                                                                                                                                                  Entropy (8bit):5.051372514206481
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24576:nrL8u313uyqoT+seqyRmX5loTUOmdAQifaQ2XxFMJGk62YhYaiiIQMX4qOwUCMdq:ng56I
                                                                                                                                                                                                                  MD5:CAEE902136579F4BAC72A6F0F75D171B
                                                                                                                                                                                                                  SHA1:CBBAF988A499005E21FD86652E1F48AF8BCE2C35
                                                                                                                                                                                                                  SHA-256:E86F677E9654F6A16A7738E85A5A5D467A09CB18E47654F079506A00AFFAD70C
                                                                                                                                                                                                                  SHA-512:C0F2E8457F71789DA8CE207AAAE2F83196DAAC868FCAA7A84DE04DD38730F8831B9643B8A404A7AA59C5B726DA02090BBA414529019F5EB9C94AC5A5AF61BC9D
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........R(..e.b...h.j...i.u...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.B...w.n...y.....z.....|.....}.......D.....I.....Q.....Y.....a.....h.....o.....v.....x.....}...............................................>....................... .................'.....P.................%.....L...................................$ ....n ..... ....4!.....!....."....=".....".....#.....#.....$.....$....G%.....%.....%....I&.....&....7'....U'.....(.....(....4)....V)....'*.....*....u+.....+.....,.....,.....,.....,....w-..........;.....L...........l/...../...../....\0.....0....L1....a1.....1.....2.....2.....2....i3.....3..../4....B4.....4....^5.....5.....5....K6.....6....-7....>7.....7.....8.....8.....9.....9.....:....I:....l:.....;.....;.....;....1<.....<....Z=.....=.....=.....>....(?....z?.....?....?@.....@.....@.....@.....A....WB.....B.....B....qC.....D....OD....pD....nE....fF.....G....-G.....G.....H.....H....$I.....I.....J.....J.....J....~K.....K....&L....GL.....L.....M.....M.....N

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\fi.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):547257
                                                                                                                                                                                                                  Entropy (8bit):5.425790227406111
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:sXTpn19l5MtWuah5EinUtWnSp0WahHNYM:yTlB5E8nRl
                                                                                                                                                                                                                  MD5:125A121C22DFC2B1A1C759CAD9123E42
                                                                                                                                                                                                                  SHA1:D0282AF9EC311C406ECCCDFDD7216B7D883E94C3
                                                                                                                                                                                                                  SHA-256:B733460F039DCB3795077BA91DAFA3B9B8163DFD0F15168B250630F7DE21ED0A
                                                                                                                                                                                                                  SHA-512:C6E0EA8FAB8115A632D4C74141EFC46EA546F43E0B806D5BD95A1ECD3B8FE37A44565A2F79C43E0BC50DBDADC5D16054E07485FAD83C99BD3550A907C852E724
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........F(%.e.J...h.R...i.c...j.o...k.~...l.....n.....o.....p.....q.....r.....s.....t.....v.0...w.\...y.....z.....|.....}.......2.....7.....?.....G.....O.....V.....].....d.....e.....f.....k.....}.......................@.................$.......................0.................G.....]...........1.....d.....y...........&.....S.....a.......................'.........................................8.....R.................0.....F.................5.....J............ ....8 ....V ..... ....@!.....!.....!.....!....K"....n".....".....".....#....A#....O#.....#.....#.....$....'$....w$.....$.....$.....$....V%.....%.....%.....%....;&.....&.....&.....&.....'....n'.....'.....'.....'....M(....v(.....(.....(....`).....).....).....*....R*....n*.....*.....*....2+....T+....m+.....+....0,....T,....c,.....,..../-....f-.....-.....-........../.....>................../....1/...../...../....&0....@0.....0....C1.....1.....1.....2....q2.....2.....2....$3....|3.....3.....3.....3....A4....Z4....j4.....4.....5....I5

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\fil.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):618874
                                                                                                                                                                                                                  Entropy (8bit):5.2024833562888055
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:fGsQ2sSp+ynDQmiSANIhxp3amx5GhV7MQoE8AYzwK:fiolx5G7s
                                                                                                                                                                                                                  MD5:EAF43729E9BBD8004EF1FF56A3D85A48
                                                                                                                                                                                                                  SHA1:34B31AB8EA2CE6BD263F00ACC50D5AF8D0222D9A
                                                                                                                                                                                                                  SHA-256:8559CC35335BB2C249297F4C7506DF95CEF899EF5F7AD942D2D511AE074D41B0
                                                                                                                                                                                                                  SHA-512:010F8E5C3B969BE0DB4BAEC3ACFFDD69BE25662387968E15E11AF0DA68EC2F45DC9EDB83CAFE7C92234E1E4E4AAE1682223235AF04D99E8B5238379E022E3D35
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........*)A.e.....h.....i.0...j.<...k.K...l.V...n.^...o.c...p.p...q.v...r.....s.....t.....v.....w.)...y.P...z.~...|.....}.....................................#.....*.....1.....2.....3.....8.....E.....Z.....p.........../........... .....:...........1.....v...........3........... .....G...........<.......................`.......................s.................J.................* ..... ....@!.....!.....!..../".....".....".....#....~#.....#....*$....D$.....$....?%.....%.....%....8&.....&....$'....F'.....'.....(....0(....M(.....(.....(....#)....0).....).....).....*.....*.....*.....*....5+....K+.....+.....,....M,....\,.....,.....-....Q-...._-.....-.... .....Q....._..........."/....T/....b/...../....c0.....0.....0....41.....1.....1.....1.....2.....2.....2.....2.....3....}3.....3.....3....G4.....4.....5....75.....5.....5....(6....B6.....6.... 7....S7....n7.....7....b8.....8.....8....k9.....:....n:.....:.....;.....;.....;.....<.....<.....<....,=....D=.....=.....=....$>....:>.....>....0?....l?

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\fr.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):637414
                                                                                                                                                                                                                  Entropy (8bit):5.391270599351283
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:ZPM7ZL85Z4p5ZR6QuaMVq0YzRnP4ZoZCMYnYyGGGDYQzc7IvO8Ixat40wCSsmlFI:ZPiYVW45F2
                                                                                                                                                                                                                  MD5:651E4CB14C4F784D36D0A1715C52DCF3
                                                                                                                                                                                                                  SHA1:540F6090E3223AD8E6424A9DB78305F2DB9974BF
                                                                                                                                                                                                                  SHA-256:6D547CBC3304627D14AEB138AEBD40786C30A4192E071D80BCECDB77A13AC80A
                                                                                                                                                                                                                  SHA-512:1FE93058EC434C06EF4AA1519333EBD831311971B06D7279DDC4D86DFA860BBD6EA6D127B2A07425C3E78BD6D41C11EB2A76CF25B20C6A7DE74D1F0CEEC87079
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.....l.....n.....o."...p./...q.5...r.A...s.p...t.....v.....w.....y.....z.=...|.d...}.....................................................................................$.....3...........{.................u...........*.....B...........`.................H.................+.........................................*.....?...........4.....w...........&.......................b ..... .....!....&!.....!.....!....;"....N"....."....9#....{#.....#....($.....$.....%....4%.....%.....%....*&....A&.....&.....&.....'..../'.....'.....'..../(....A(.....(.....)....G)...._).....)....(*....\*....q*.....*....#+....O+....]+.....+.....,....<,....K,.....,.....-....A-....U-.....-....X.................7/...../...../...../....)0....{0.....0.....0.....1.....1.....1.....1....s2.....2.....3....i3.....3.....4.....4....D4.....4....05....l5.....5.....6....t6.....6.....6....c7.....7....48....G8.....8....99....~9.....9....1:.....:.....:.....;....q;.....;.....;.....<.....<.....<....7=

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\gu.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1247969
                                                                                                                                                                                                                  Entropy (8bit):4.3234098874611675
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:dYXCzHrul8BRuh7x4kvm/RbIwjAwREJKVMjNiT7llj63rFulPCaSi5NAWsWi//Go:SgruQuhd4kOv0wv5qdhX11oG
                                                                                                                                                                                                                  MD5:6C949199EAAAD8FCB12C38EC6C02D758
                                                                                                                                                                                                                  SHA1:CE4DBD5E6A37F25354EC6849F7008956EF3568BA
                                                                                                                                                                                                                  SHA-256:966591A74E44C75C7F0114BB8E36B0E9F5502AEBDC96C714C8A8F6D45BC863C8
                                                                                                                                                                                                                  SHA-512:3344E0083969DE6F4913893A14586B441F65CB5D45F913F1CEA61B8D5ABBDB3B1C18A48731870282174263C1F306ED6B99C279627BD269E89CD4E15DC3D88313
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.)...l.4...n.<...o.A...p.N...q.T...r.`...s.....t.....v.....w.....y.....z.\...|.....}.........................................................................8.....]......................."...........B.....5...........y.......................p.................7 ..... ..... .....!....."....h"....."....H#.....#....2$....R$....5%.....%....P&.....&.....'.....(....,)....n)....D*.....+.....+.....+.....,....k-.....-.........../.....0.....0.....0.....1.....2.....3.....3....q4.....5....F5....m5....&6.....6.....7....C7.....7.....8.....8.....8.....9....s:.....:.....;.....;....|<.....<.....<.....=....S>.....>.....>....g?.....@....n@.....@....@A.....A....KB....jB....}C.....D....2E....hE....!F.....F....(G....QG.....G....VH.....H.....H....WI....8J.....J.....J.....K.....L....JM.....M....oN.....O....RO.....O....gP....-Q.....Q.....Q.....R....zS.....T....<T....cU.....V....^W.....W.....X.....Y.....Z....fZ....R[.....\.....\.....\.....]....I^.....^.....^....._.....`....ta

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\he.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):769483
                                                                                                                                                                                                                  Entropy (8bit):4.624517967326664
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:HwRkrhVzCDkVF2TWrqnV3mWqu/rHQxssACnX+8eQCajZ5Q69Zt+yr4w5ONmmEkcU:QU5J+f
                                                                                                                                                                                                                  MD5:16562C59FBA469E1DD2F3B0B87A64645
                                                                                                                                                                                                                  SHA1:9A6863205FCA8EA6D09A98B8E8DAB543FF6198A1
                                                                                                                                                                                                                  SHA-256:64FA2E98A9056E23C3A934FF39FEF81C306CEC5844D56DDA17EC6C25FCDB1B5A
                                                                                                                                                                                                                  SHA-512:DBB6E1A5E52A005386007F88B53109037792BC7B65FB95ACE3E8CC5AE3EBD8320C7E406381C375BF751A9265ACE84E0BBE1301D4BF3AA79200EC789DC3B3BC0B
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.F...t.]...v.....w.....y.....z.....|.:...}.k.........................................................................................0.................(.....J...........H................._...........R.....r...........z.................p.........../.....@...........#.....R.....t...........o.................v ..... ....D!....h!.....".....".....".....#.....#.....#....=$....T$.....$....Y%.....%.....%....|&.....'.....'.....'....2(.....(.....(.....(....m).....).....*.... *.....*....<+.....+.....+....&,.....,.....,.....,....n-.....-....".....7............/....X/....i/...../....Q0.....0.....0.....1.....1.....1.....1....|2.....3....T3....s3.....3....[4.....4.....4....%5.....5.....5.....5....^6.....6.....7....67.....7....I8.....8.....8....>9.....9.....9.....9....R:.....:.....:.....:.....;.....<....d<.....<....\=.....>.....>.....>....X?.....?.....@....P@.....@.....A.....A.....A....wB.....B.....C....3C.....C....vD.....D

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\hi.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1316094
                                                                                                                                                                                                                  Entropy (8bit):4.298990624339052
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:Pk/xu63zEz67Esk0GjV/BB0ZV1dKu4lYvD6OEOTByntDPtDlZpfRQhs4fe/8bR8E:8/xt3zEMEn0WXo5CKMhZQ
                                                                                                                                                                                                                  MD5:6AA92C296ED09FE2AA94DC060B25774A
                                                                                                                                                                                                                  SHA1:7619ED3DC5B1E04C55B0EE7280AC2D0135EB9C80
                                                                                                                                                                                                                  SHA-256:0C771C66DB4F80A62912564944C4E239F8DAC8381A06483ECAB512E0D75744A1
                                                                                                                                                                                                                  SHA-512:9255A4FFEF7BE07CEAB5DD8F46365B9A52D621AE175C1022BB4685FE4F3EA63425F45AA9EF824B467B9C33C51A7104258E888E8EC15C88FEA126BF0B5337FF14
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........_(..e.|...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.-...v.b...w.....y.....z.....|.....}.;.....d.....i.....q.....y.................................................................E.....~...........X.................v...........;.....i...........x.................. .....!....N!....!"....."..../#...._#.....$.....$.....%....5%.....&.....&.....'....\'.....(....e).....).....*.....*.....+....',....P,....7-.....-....e............/.....0.....1....O1.....2.....3....L4.....4....`5.....6....f6.....6....J7.....7....N8....y8.....9.....9.....9.....9.....:.....;.....;....,<.....<.....=.....=.....>.....>....{?.....?.....?.....@....;A.....A.....A....cB.....C....uC.....C.....D.....E....%F....UF.....G.....G.....H....5H.....H....QI.....I.....I....iJ.....K.....K.....K.....L....ZM.....M....4N.....N....zO.....O.....O.....P.....Q....TR.....R.....S....:T.....T.....U....qV.....W.....X.....X.....Y.....Z....$[....f[.....\.....].....^....m^....a_.....`.....`.....`.....a.....b.....c

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\hr.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):594999
                                                                                                                                                                                                                  Entropy (8bit):5.5194556553046565
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:ISmsqAZ/pqidI7/Rw6GhT0ww57V9YMrbLPDK:ISm/iEidI7/Rw6q0B5jYAzK
                                                                                                                                                                                                                  MD5:FDA338824B4171B10DCC3395A549FA9F
                                                                                                                                                                                                                  SHA1:EA42C8B18228E0CA57B8ED7ED48E3A2AEBE08486
                                                                                                                                                                                                                  SHA-256:43F370368B322CD1236632C82AA0E231965DC58FDD497F8AEAE6B40EEF9EE611
                                                                                                                                                                                                                  SHA-512:9115F805F51F45839E0A87CF44C1CCE311CECAF717C0DA7DB3B6DA85CEA95F24638AF29DA43BC01056994B22049DAA0387CD4371C13B8E5399FE8F4E38771D57
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.$...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...q.....r.....s.....t.....v.....w.6...y.]...z.....|.....}.........................!.....).....0.....7.....>.....?.....@.....B.....N.....Z.....h.....y.......................#.................'.....<...........3.......................s.................".............................f.......................r.................O.................<............ ....L ....d ..... ....(!...._!....s!.....!....["....."....."....U#.....#....B$....e$.....$.....%....:%....V%.....%.....%.....&.... &....f&.....&.....&.....&....D'.....'.....'.....'....H(.....(.....(.....(....G).....).....).....)....H*.....*.....*.....*....,+.....+.....+.....+....<,.....,.....,.....-....j-.....-.....-.....-....T.......................2/...../...../...../....F0.....0.....0.....1....{1.....1.....1.....2....v2.....2.....3.....3.....3.....3....P4....m4.....4....y5.....5.....5....b6.....6.....7....-7.....7.....7.....8....08.....8.....8.....8.....8....j9.....9.....:

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\hu.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):640919
                                                                                                                                                                                                                  Entropy (8bit):5.644940180075165
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:oeo/GHgmRXxhsRd9gHo2pKJDAxukitluTd5kt8zZ9pwJcYNV9SLg+4ev6DbnjDiw:Ho/GBwHAZd5kt8Ex9y+O5LG9b
                                                                                                                                                                                                                  MD5:7ADD28FBBBA1CE87972F6433862DCBAA
                                                                                                                                                                                                                  SHA1:8B4B0053663C0B69BECA59FACA79854A89AB9C97
                                                                                                                                                                                                                  SHA-256:DD86976D72F3CB644B90C1863E29E2F8616B09AC4ACFE9301FB346FA0D87BD78
                                                                                                                                                                                                                  SHA-512:EFED0891B0202BAE9396DF54F141A73BB6CCADD7947330FD9E6A3A8911E9E037454238C4BD2BB9075AF3218230C9E4E394F83A70878396911FAA282D99FDD884
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.D...t.[...v.....w.....y.....z.....|.8...}.i.....................................................................................................~.............................L....._...........c................._.................'.................(.....9.................H.....i...........i.................s...........X ....| ..... ....b!.....!.....!....!"....."....."....."....s#.....#....6$....P$.....$....s%.....%.....%....\&.....&.....'....-'.....'.....(....,(....D(.....(.....)....G)...._).....).....*.....*.....*....U+.....+....+,....A,.....,....L-.....-.....-............................Z/...../.....0....B0.....0....W1.....1.....1....#2.....2.....2.....2....J3.....3.....3.....3....`4.....4.....5.....5.....5.....6....i6.....6.....7....U7....y7.....7.....7....T8.....8.....8....(9.....9.....9.....9.....:....,;.....;.....;....R<.....<...."=....V=.....=....e>.....>.....>....8?.....?.....?.....?....q@.....@....'A

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\id.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):529383
                                                                                                                                                                                                                  Entropy (8bit):5.3800306514954634
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:MB38e1B6x8b+tQqAHcAef+eVnjHF/TmiZAWO5AVpWOBhUnNiT8kLHp:MB38erqPA2VnjHFbm8At5AVpLp
                                                                                                                                                                                                                  MD5:CFC848689A25F5E2E6BA9A06E09B6EE0
                                                                                                                                                                                                                  SHA1:35131E775D98A57FFCBD6A75E69F6F67437636C3
                                                                                                                                                                                                                  SHA-256:EC1D7BBE064656DC53F70E3A612A582F5D5D0AF5F0C2D6A783796CFFA5BF7F57
                                                                                                                                                                                                                  SHA-512:D5A027E35DD3846F5255B81EED36A3498AC9D809367692B2DA216B5771C2D54FAD35FC15C15705A2BBB4A7B35DD2245661882734998F9BC3AD8D62D2273B6577
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.(...l.3...n.;...o.@...p.M...q.S...r._...s.....t.....v.....w.....y.-...z.[...|.....}......................................................................... .....-.....=.....O...........5.....}.................6.....c.....o...........6.....y.................P.......................K.....{.......................=.....T.................B.....f.................P.....g.................4.....A.......................#.................$ ....7 ..... .....!....W!....k!.....!.....!....."....."....g"....."....."....."....-#....x#.....#.....#.....$....Y$.....$.....$.....$....>%....m%....w%.....%.....&....B&....L&.....&.....&.....'....('.....'.....'.....(.....(....q(.....(.....(.....)....Y).....).....).....).....*....T*....s*.....*.....*....2+....]+....p+.....+.....,....G,....i,.....,.....,.....-.....-....w-.....-.....-..........v................../...../.....0....f0....u0.....0....?1....y1.....1.....1....F2....t2.....2.....2.....3....,3....<3.....3.....3....24

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\it.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):581016
                                                                                                                                                                                                                  Entropy (8bit):5.296715563664076
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:Mkqu5NjNJ2IU9UTx994eN7NgvESIqRRxsO1ytnvWjRT9Tj+rhazYDxrvAqpzSw9S:MkSLlZm128uJekfzEpe5kLISa
                                                                                                                                                                                                                  MD5:6AA3BC3EE4999C324B82E50940E62C74
                                                                                                                                                                                                                  SHA1:10AF8030FC2F875E133C9417E0221528160AD8B5
                                                                                                                                                                                                                  SHA-256:73CC8422643A65753B2C3672C8F8331EE92C9BDDC912576554E95B0986CF990D
                                                                                                                                                                                                                  SHA-512:F039EF32002E55D09A4F567CC81FE2B3B329D517C985436A5DA121FF0E6AC7E258B5D1FDDA81E6C1578DAF7078B91ABCFB7DA98CDBA6693D4FBE7F28115E6971
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.....l.!...n.)...o.....p.;...q.A...r.M...s.|...t.....v.....w.....y.....z.I...|.p...}...............................................................................".....;.....L...........u.................d...................................r...................................G............................._.......................v................._.................S..........." ....h ....y ..... ....9!....s!.....!.....!....`"....."....."....G#.....#.....$....,$.....$.....$.....%....$%....t%.....%.....%.....%....@&.....&.....&.....&....#'.....'.....'.....'....+(....~(.....(.....(.....)....Y).....).....).....)....-*....[*....d*.....*.....+....:+....E+.....+....,,....z,.....,.....,....6-...._-....x-.....-.....-.................................../...../...../..../0....l0.....0.....1....31....H1.....1.....1.....2....!2.....2.....3....Y3.....3.....4.....4.....4.....5.....5.....6....[6.....6.....7....r7.....7.....7....!8....a8.....8.....8.....9....c9.....9

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\ja.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):708098
                                                                                                                                                                                                                  Entropy (8bit):5.712005061370792
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:SCG5Mw77QWN7v5DD79ZgQ21XymbA5zFLdbvVt:SrSw7NN7F9ZgQ21Xi5zFLdj
                                                                                                                                                                                                                  MD5:5A69547F56DC61E482DCDA1CE704C5AC
                                                                                                                                                                                                                  SHA1:5B7BBC8E9B14D78F2105136AFB7728050128C02E
                                                                                                                                                                                                                  SHA-256:A286A5FAF9021927EC09FD8CBF30ED14AD59C3BAA36D29E5491AD27B957915E5
                                                                                                                                                                                                                  SHA-512:2B9D020544201E2D0B0B44B0977FCBAB858563969CE02BE65689C5F5B780ADC4560DF523589293CD66F42903322ED61D781DA093ADFA44AA0681A28D97DE4556
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........'..e.f...h.n...i.y...j.....k.....l.....m.....o.....p.....q.....v.$...w.P...y.w...z.....|.....}.......&.....+.....3.....>.....F.....U.....Z.....b.....i.....p.....w.....y.....~.........................................l...................................p...........S.....n.....4...........P.....{...........k.......................|.................H............................. .....g.................h ..... ..... .....!.....!.....!.....!....6".....".....".....".....#....4$.....$.....$.....%....w%.....%.....%....;&.....&.....&.....'.....'....%(....l(.....(....4).....).... *....D*.....*....I+.....+.....+....#,.....,.....,.....,....j-.....-..........+...........6/...../...../....80.....0....(1....G1.....1....A2....{2.....2.....3.....3.....3.....3....Z4.....4.....5....35.....5....?6.....6.....6....*7.....7.....7.....7....B8.....8.....8.....9.....9.....9.....:....5:.....:....|;.....;.....;.....<.....=...._=.....=.....>.....>.....>.....>....z?.....?...."@....>@.....@....LA.....A.....A

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\kn.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1424056
                                                                                                                                                                                                                  Entropy (8bit):4.241400387342817
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:X3WMqESgQzb4OpsJHVLl6S3AE745LmWA4hqSm2G:Nqed65qWo
                                                                                                                                                                                                                  MD5:52A0707A70B939BCD75B0838A5DC5357
                                                                                                                                                                                                                  SHA1:EB9E1350D9D217580B1939302D008DC07C3B781C
                                                                                                                                                                                                                  SHA-256:B177EDA102B1BE8C53127E3BB47970A3C1E2032BE24900D8A126C5F0F077EF3D
                                                                                                                                                                                                                  SHA-512:D5FE69035338C4308F661FA0AC25C4A811A6014F6BD85CCC7AD947F76AECF76F67208512E1266E249EC067A5FB22FB74A3550B0F3AEB1BC50FADB3A9D3CC67E4
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.B...h.J...i.[...j.g...k.v...l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.T...y.{...z.....|.....}.......*...../.....7.....?.....G.....N.....U.....\.....].....^.....c.......................].............................D.....L...........[.................. ..... .....!....."....`#.....#....\$.....$....S%.....%....t&....='.....'.....'.....).....)....t*.....*....5,....D-..........|....../....V0.....0....%1....42.....3.....3.....3....,5....B6.....7....T7.....8.....9.....:....C;.....;....u<.....<.....<.....=....C>.....>.....>....X?.....?....A@....V@....9A.....A....zB.....B.....C....BD.....D.....D.....E....EF.....F.....F.....G....sH.....H.....I.....I.....J.....K....CK....eL....dM....$N....SN....6O.....O....TP.....P....AQ.....Q.....R..../R.....S.....S....1T....cT.....U....SV.....V....hW....PX.....X....UY.....Y.....Z.....[....*\....|\.....].....^....W_....._....+a.....b.....c.....c....;e....9f.....f....og.....h.....i....2j.....j....Lk.....k...._l.....l.....m.....n....`o

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\ko.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):599188
                                                                                                                                                                                                                  Entropy (8bit):6.077314293748852
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:Twg3X8cvlA/t0ZTvIXzxMSAG0GlzRXhw3zTt8Onat7DXCqYwHs5Ra1i7vlq5zULq:TH75vKpCWj
                                                                                                                                                                                                                  MD5:4B563EB612D4FADC6BD8A4C918006AB1
                                                                                                                                                                                                                  SHA1:4B9E414AF0C044C4487D1439D23EF11B0169D308
                                                                                                                                                                                                                  SHA-256:E0D4461452607E0F4A619EFE653EC9EC39F7D34A742AE98374B2BCE0B821ADC9
                                                                                                                                                                                                                  SHA-512:B8C56D69FA41AD14F7197ACAB1BA987EBB06C5B15748E21CEC27861721545E30FB20F76F2C3A752C8EA94CCA1E6B4FAB7FB0727B679A8FB8E94DB2D5C028E7A6
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........'..e.....h.....i.%...j.0...k.\...l.d...m.l...o.....p.....q.....r.....s.....t.....y.'...z.U...|.|...}.........................................................................+.....;.....N.....^...........Q.................(.......................[.................#.................5.....I.................<.....L.................?.....R.................B.....]...........;.....p.................?.....m.....z...........1.....].....j...........<.....t............ ..... ..... ..... ....P!.....!.....!.....!....0"....~".....".....".....#....Y#....~#.....#.....$....r$.....$.....$....3%.....%.....%.....%....>&.....&.....&.....&....E'.....'.....'.....'....B(.....(.....(.....(....`).....).....*..../*.....*.....*.....*.....+.....+.....+.....,.....,.....,.....,.....-.....-.....-..........L.....|............/...../....+/...../...../.....0....(0.....0.....0.....1....-1.....1....+2....q2.....2.....2....X3.....3.....3.....4....h4.....4.....4.....5....]5....}5.....5.....5....R6.....6.....6.....7

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\lt.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):644262
                                                                                                                                                                                                                  Entropy (8bit):5.6356477666035865
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:kjFt+0US0MAcrMqecJwuxZ5b7MjC3jqt6S0M:WFQ0GMnrLZ5sjIjqN
                                                                                                                                                                                                                  MD5:7CEF6E31D76861DB4D7D622FDD89E5AA
                                                                                                                                                                                                                  SHA1:31FA45C3B7666259D4D8A13518ECE423A97EDCCA
                                                                                                                                                                                                                  SHA-256:2F1E1C69DA5CAD8F47E45AF0AC47CEC90C20FE2897A43CB496C7FEED1EC5D1AB
                                                                                                                                                                                                                  SHA-512:DF66A739F3A8DA62A942B56B23F71A2B68469E87DC44EB8CE1A9A859A609F1DB4BEE2497DEFEF06FA48E14CF461E61410668A5216459C94C79F4B69A3CF092F6
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.#...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.C...z.q...|.....}.................................................$.....%.....&.....(.....6.....C.....W.....h....................... ...........6.....}...........0.................$.................S.....m...........f.................$.......................w...........%.....J...........] ..... ..... ....5!.....!.....!.....!....j".....".....#.....#.....#....F$.....$.....$....7%.....%.....&....3&.....&.....'....<'....W'.....'....:(....j(....|(.....(....h).....).....)....(*.....*.....*.....*....m+.....+....',....6,.....,....4-....o-.....-............................6/...../...../...../.....0....%1....x1.....1.....2....|2.....2.....2....W3.....3.....4....<4.....4.....5....d5....|5.....6.....6.....6.....6....l7.....7.....7.....8.....8....19....s9.....9....$:.....:.....:.....;.....;....T<.....<.....<....G=.....=.....>....)>.....>....[?.....?.....?.....@....r@.....@.....@....+A.....A.....A

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\lv.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):643309
                                                                                                                                                                                                                  Entropy (8bit):5.637177021245093
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:Uz9waCt7x2/28mvsf4xN3tVF89voxEJiiUh/7bOEw5hp1UrFeTE/CoCKbnh2Degl:UFuKvNMEGFOEw5WFeTunbf35S
                                                                                                                                                                                                                  MD5:00B517CE675A3089823708776C6F9302
                                                                                                                                                                                                                  SHA1:2BC24F150ADAAFD2604C5D95BBAAF8DC983D7DA2
                                                                                                                                                                                                                  SHA-256:0ADEDD1EAAF902FEEBB208220D9F21AE1B0175E74F6A966CD7ED226146D86AE8
                                                                                                                                                                                                                  SHA-512:6C19A0D779185141FB050369F9FBFE60D0B838E55E2674E3F14A67E1A6970727E329656E458CA8516A41C97B20E67EB1789587AF957129B3D32C94A3536AB12E
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.2...w.^...y.....z.....|.....}.......4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....j.....}.......................\...........k...................................\...........R.....o.............................:.......................j...........2.....D...........4.....f...........% ..... .....!....A!.....!....B".....".....".....#.....#.....#.....#...._$.....$....E%....b%.....%.....&.....&.....'....X'.....'.....'.....(....b(.....(.....(.....)....n).....).....*.....*.....*....0+....u+.....+.....+....p,.....,.....,.....-.....-.....-.....-....N............/...../...../.....0....G0....X0.....0.....1.....1.....1....K2.....2.....2.....2....`3.....3.....4....=4.....4.....5....15....@5.....5...._6.....6.....6....:7.....7.....7.....7....b8.....8.....9....39.....9....1:....u:.....:....+;.....;....P<....c<.....<....f=.....=.....=....5>.....>.....>.....?....o?.....?.....?.....@.....@....-A....qA

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\ml.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1481376
                                                                                                                                                                                                                  Entropy (8bit):4.274098791777635
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:gtUOGVx75aWEyghv479y6DPnXKfhBP1zXnxooG98MF3e7hDK5V6jX9fb3VV:gtuxmGKfhBP1zX23F3ek5V6jX9D3j
                                                                                                                                                                                                                  MD5:D32A29A61E8AFABA6B42D236257D9929
                                                                                                                                                                                                                  SHA1:9664F50EA7590A47C2EB8EB4A3E49BE556D08F7A
                                                                                                                                                                                                                  SHA-256:A59FD15C969EE8FFD7E72F5A2245C6A5A4FC048F7899FCA489D78C8F6394CA1E
                                                                                                                                                                                                                  SHA-512:2668976853B26B22859F8C20AFAEB4D641845E94779B8994B49F240302420279E3F9A99666B8F551495B7D5A8C3C83609B7ECF276FABD8345CC8C787319EA3D2
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.@...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.&...w.R...y.y...z.....|.....}.......(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....a.......................j...........<.....+.....x.................B.................] ....L!.....!.....".....#....h$.....$.....%....Y&.....&.....'.....'.....(....t).....).....*....n+.....+....4,.....-..........X/...../.....0.....1....W2.....2.....3.....4.... 5....d5.....6.....7....o8.....8....I:.....;.....<.....<.....=....U>.....>.....>.....?....g@.....@.....@.....A.....B.....B.....C.....C.....D....AE....uE....YF.....F....pG.....G.....H....YI.....I.....J.....J.....K....BL.....L....NM.....N.....N.....N.....O.....P.....Q.....Q.....R.....S.....T....DT.....U.....U.....U....?V.....W.....W.....X.....X.....Y.....Z.....[.....[.....\.....].....^....E^....g_....^`.....`....?a....~b....@c.....c....>d....le.....f....dg.....g.....h.....i.....j.....j.....l.....m.....m.....n.....n.....o....Pp.....p.....q.....r.....s

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\mr.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1222173
                                                                                                                                                                                                                  Entropy (8bit):4.300698800250203
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:gOG1c9CX6VI4KBYmiMpvVL8lownlWGrInbizwF/yGRu3RxYR3GodgEWYJrOznupW:fG0m4lwcasmKZKbzNvfq1E5imHReZ
                                                                                                                                                                                                                  MD5:0E5B29B6AE74A1F94CA4F880F131A79F
                                                                                                                                                                                                                  SHA1:6AC5089ACE05847480D2AEEC89954124CAA781AA
                                                                                                                                                                                                                  SHA-256:25BF8E86F7C9E88F68D4C40C4F124C16F60DAF22E7A87F55BA2C560A0F640BC9
                                                                                                                                                                                                                  SHA-512:30717C0AEF4458BBCF7472316727981829EDADA8BE3003AFD9D65CB01D4CF309F601B1C41539343D6239CB2E9157554C95CF966A4156458A2FD78D2464075C98
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........q(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.C...t.Z...v.....w.....y.....z.....|.7...}.h...................................................................................-.....z.....................................................R...........U............ .....!....6"....b"....5#.....#....P$.....$....^%....-&.....&.....&.....'.....(.....)....T).....*.....,.....,....5-....S.....V/...../....$0....K1....K2.....2.....3....C4....a5.....6....J6.....7.....8.....9.....:.....;.....;....9<....s<....6=.....=....+>....W>.....?.....?.....?.....@.....A.....A....\B.....B....|C....RD.....D.....D.....E....uF.....F.....F.....G....uH.....H.....H.....I.....J.....J.....K....RL....{M....=N....|N....;O.....O....4P....]P.....P.....Q.....Q.....Q.....R.....S.....T....+T....TU....OV.....V....eW....OX.....Y....mY.....Y.....Z.....[....k\.....\.....].....^....n_....._.....`....Qb....:c....ac.....d.....e...._f.....f.....g.....h.....i....]i.....j.....j....Wk.....k.....l.....m....!n

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\ms.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):554824
                                                                                                                                                                                                                  Entropy (8bit):5.250627975386066
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:1fZuPdEaPHdoDKUaxe+2cgFRlWWNxTUcWR95bxlqyGkuBm9ch:xg9HEsxd2hlWEG95vFG3
                                                                                                                                                                                                                  MD5:6149507C3AA99C4012D9D7CFE4BC30C8
                                                                                                                                                                                                                  SHA1:51A2BB5CBAE64F3877AFC342EA0F43915702F8F4
                                                                                                                                                                                                                  SHA-256:DD75481D67D9BE36ECB2E421117395FBB75B7623164F13A09BE1CF3CE76D588F
                                                                                                                                                                                                                  SHA-512:71F8DC03618D46BE7B036353526BF20A61E648EF50ADEEEC057D314E9A4536899C37EF691164BF9DE9E10A3867749F8D3D6F4038E16C82CF6122E7AB4A1C7732
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.^...h.f...i.n...j.z...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.;...w.g...y.....z.....|.....}.......=.....B.....J.....R.....Z.....a.....h.....o.....p.....q.....v.............................d...........4.....O.................B.....R...........0.....q.................^.......................f.......................[.......................`................./.......................P.......................- ..... ..... ..... .....!....y!.....!.....!....8".....".....#.....#...._#.....#.....#.....#....!$....t$.....$.....$.....$....G%....n%....z%.....%....A&....{&.....&.....&....I'....~'.....'.....'....?(....q(....{(.....(....-)....])....f).....).... *....S*....^*.....*....A+.....+.....+.....+....B,....g,.....,.....,...."-....F-....`-.....-.....-....(.....9................../....@/...../...../...../...../....U0.....0.....0.....0....e1.....1.....1.....2.....2.....3...._3....m3.....3....<4....w4.....4.....4....I5....w5.....5.....5.....6....;6....K6.....6.....6....&7

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\nb.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):537830
                                                                                                                                                                                                                  Entropy (8bit):5.4264919827777245
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:GFxHxFb73kroOp7fBpHXYbhOs5wk+bhPLgg5t:GXxFXkJ1YbhOs5f+bFUG
                                                                                                                                                                                                                  MD5:2A0EC73D03D4D7FCEC71AD66CC0D4B30
                                                                                                                                                                                                                  SHA1:BB8DF6E11B02086726ECEDE97D5F729F4197323C
                                                                                                                                                                                                                  SHA-256:D44EF5E644B1B8F7C056D5E20651515FCC8565BEFEC575091735FB39C6D63554
                                                                                                                                                                                                                  SHA-512:CDCB4E436270156E263D731CE243D821C5361B18B6D7B8259875C9D895301D478A87FEB7CAFC3376D09D18D27F32DC403FD2CBD034D68736CB968BBEFEBD642B
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h. ...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.0...y.W...z.....|.....}...............................#.....*.....1.....8.....9.....:.....<.....G.....V.....i..................................._...................................n.................P.......................M.....w.................:.....c.....r...........B.....r.................w.................`...........- ....L ..... ....&!....^!....r!.....!....r"....."....."....m#.....#....J$....l$.....$.....%.....%....'%....}%.....%.....%.....&....`&.....&.....&.....&....I'.....'.....'.....(...._(.....(.....(.....(....a).....).....).....*...._*.....*.....*.....*....Q+.....+.....+.....+....`,.....,.....-....5-.....-.....-................x................../....[/...../...../...../....b0.....0.....1....F1.....1.....1.... 2....92.....2.....3....23....J3.....3.....4....J4....^4.....4....95....u5.....5.....6.....6.....6.....7....o7.....7.....7.....8....Y8.....8.....8.....8....<9.....9.....9

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\nl.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):556268
                                                                                                                                                                                                                  Entropy (8bit):5.362124110769206
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:jVAWY0lbJ9WQusFUiFgN5tmDdx5btfKzaWDZqqn9pmTy:qWY0lbJ9WQusFU15tmDdx5bFKzaWVqq1
                                                                                                                                                                                                                  MD5:E8B790166D701F63A60C3B322FCCE234
                                                                                                                                                                                                                  SHA1:61EC318AA8030F7D29C3258126B156D1D3EEFA2C
                                                                                                                                                                                                                  SHA-256:3D73B0110E5832B6A7C7B7E64018368464EF8552D6A98592D0ADBF713EB9755E
                                                                                                                                                                                                                  SHA-512:4E4B299CB55CBB5906FF974BB5E5078D2018298B5EE6D9CA0E40AAB8DB542AAEDC4BD7A5DB242A2C5194BC90C07631F627043DCC1A9F2D095A28C3E35F212DD9
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k."...l.-...n.5...o.:...p.G...q.M...r.Y...s.....t.....v.....w.....y.'...z.U...|.|...}...............................................................................(.....9.....K...........m.................W.......................{...........3.....I.................L.....c.................7.....F.......................(.................7.....X...........0.....g.................E.....z.................T ..... ..... .....!.....!.....!.....!....[".....".....#....3#.....#.....#.....#.....$....X$.....$.....$.....$....,%....}%.....%.....%.....&....|&.....&.....&.....'....u'.....'.....'.....(....U(.....(.....(.....(....4)....`)....m).....)....)*....]*....l*.....*....H+.....+.....+.....,....W,.....,.....,.....,....=-....^-....u-.....-....+.....S.....e...........7/....n/...../...../....<0....Z0....n0.....0....21....d1....u1.....1....G2.....2.....2....-3.....3.....4.....4.....4.....5....D5....i5.....5....46....e6....z6.....6.....7....A7....Q7.....7.....8....A8

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\pl.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):619265
                                                                                                                                                                                                                  Entropy (8bit):5.770526396702215
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:zifPIC1WoOB/ktv/XfQfuzSJY9HQbyDPSCUd4e3m7UyMgmx1QhH1b5FuH4VZy:YTxbMJ1Qh15w
                                                                                                                                                                                                                  MD5:8A4354163FF3B0978A568F781BDAC289
                                                                                                                                                                                                                  SHA1:45DE421F35AF79ADF962809CF8D0E6D2ADBCB553
                                                                                                                                                                                                                  SHA-256:2F6DE0F9A46AE0B75BEB67E09FFEEE12483842A7CD6F2A2382CCBE36FBFC17E3
                                                                                                                                                                                                                  SHA-512:5760F20228AFE74E9FF2A916A168E8CC2D4A64D8E76065E61A7A60616A473C7DC3DA4805125B270F179B7A0F291071E81D761D82EEC3B130D552B57ABD76C127
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i./...j.9...k.H...l.S...n.[...o.`...p.m...q.s...r.....s.....t.....v.....w.&...y.M...z.{...|.....}..................................... .....'.........../.....0.....2.....A.....O.....d.....y.........................................%.....8...........M.......................u................./.......................(.......................I...................................I.....n...........8 ....p ..... ..... ....M!.....!.....!.....".....".....".....".....#.....$....d$.....$.....$....$%....9%....Z%.....%.....%.....&....&&....o&.....&.....&.....&....O'.....'.....'.....'....](.....(.....(.....(....Y).....).....).....)....J*.....*.....*.....*....:+.....+.....+.....+....Q,.....,.....-....+-....y-.....-.....-.....-....Y.......................E/...../...../...../....g0.....0.....1....@1.....1.....1.....1.....2....s2.....2.....2.....3.....3.....3....+4....E4.....4....85.....5.....5....%6.....6.....6.....7....c7.....7.....7.....7....@8.....8.....8.....8....$9.....9.....9

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\pt-BR.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):581655
                                                                                                                                                                                                                  Entropy (8bit):5.426534241883623
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:mHM4QhMCJi4wNNBXBLGfs9y+z5GHNXun0msRgMpI2:CchHi4wD50XosR9pN
                                                                                                                                                                                                                  MD5:B1AB7D7AA67A7B61BFA9AEBAD0B812AF
                                                                                                                                                                                                                  SHA1:95EFF4BE517C0A25C34578DEF10D48C77021DE1A
                                                                                                                                                                                                                  SHA-256:5BD503C413AAF8FA87FD47C341D437ACCC25397A50B082068BCF2F3BB4FB27C7
                                                                                                                                                                                                                  SHA-512:8498FE7727771DF3C1EB34560C1E25B0C30690C7C921104B4ADCF04CC5753462BAC513A60A5833CB6F57733201D4883605F8A4EC4A457F3EBC7C952090B1A9E1
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.-...j.9...k.H...l.S...n.[...o.`...p.m...q.s...r.....s.....t.....v.....w.&...y.M...z.{...|.....}..................................... .....'.........../.....0.....5.....G.....W.....y.............................%.................%.....5...........R.................4.......................6.............................r.................G.................'.................d................._ ..... ..... .....!....}!.....!.....!....J".....".....#....!#.....#....-$.....$.....$.....$....>%....d%....w%.....%.....&....d&....s&.....&....+'....`'....n'.....'....4(....o(.....(.....(....-)....^)....j).....).....*....:*....D*.....*.....*.....+.....+....}+.....+.....,....$,.....,.....-....q-.....-.....-....'.....K.....`................../....y/...../...../.....0.....0.....1....F1.....1.....1.....2....-2.....2.....2.....2.....3.....3.....3....(4....D4.....4....D5.....5.....5....A6.....6.....6....'7.....7.....7.....8.....8....e8.....8.....8.....8....`9.....9.....:....!:.....:

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\pt-PT.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):585544
                                                                                                                                                                                                                  Entropy (8bit):5.398721361990628
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:EdZCITRW+kQdJs7ieJVJJxhbHMm5wfBCV5z6jPdoSR7oF:6XJksvMV5+jPSSR7Y
                                                                                                                                                                                                                  MD5:CBE5E35F844F5F1400DF3685CC847694
                                                                                                                                                                                                                  SHA1:E60CDB0A813A97C8548C878276BFAE155350BB42
                                                                                                                                                                                                                  SHA-256:6B9BD714D217D596183894FFED3174A617E1C8CFAE292231D4B967183B589C6B
                                                                                                                                                                                                                  SHA-512:96046C97436A3DBF5AAC479B9EAA9DFDCFC81F1EDCAEE9CD65D59BEB0CE6B6B42828E0D170AAEF2EF1D68988F7916AC1DBAC0D84218DE83FEDCCA8592DE4C1F1
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.X...h.`...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.>...w.j...y.....z.....|.....}.......@.....E.....M.....U.....].....d.....k.....r.....s.....t.....y.............................U...........=.....Z...........%.....p...............................................8.....\.................).....9.........................................O.....}...........].................- ..... ..... ..... ....L!.....!.....!....."....i".....".....#....3#.....#....)$.....$.....$.....$....U%.....%.....%.....%....C&....t&.....&.....&....F'.....'.....'.....'....V(.....(.....(.....(....W).....).....).....)....:*....g*....q*.....*.....+....@+....J+.....+.....,....5,....F,.....,....$-....t-.....-.....-....4.....^.....z................../....$/...../...../.....0..../0.....0.....1....U1.....1.....1.....2....H2....Z2.....2.....3....>3....S3.....3.....4....b4....|4.....5.....5.....5.....5....u6.....6....,7....P7.....7....38....s8.....8.....8....'9....L9....a9.....9..../:....k:

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\ro.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):606335
                                                                                                                                                                                                                  Entropy (8bit):5.4540537912984615
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:kxrPkiHXWrfGENd49ow6q0gdKXKkQGXq5e3jUZGs2hj/Xrbf:CrxXWr3Nu9o7qHKasq5ezUuj/3f
                                                                                                                                                                                                                  MD5:5DB10EDF772656C0808DD8DA698334BF
                                                                                                                                                                                                                  SHA1:3CAF7C9D5A3B44E06E0588DABA698B6970EA06F5
                                                                                                                                                                                                                  SHA-256:73B6A63352906D77196F38A1DF937EC0770160FB7A93321867C7994ED3E7967B
                                                                                                                                                                                                                  SHA-512:EB253B548C7F574943136764A23818F9DEDEA17FF42F92DC8591F4B7C297ACCDDE9F6B2C0AD96F1FD0815C53940C0102A90C603F9F4D6D9C8FB053B559CC7A62
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.!...j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.?...z.m...|.....}................................................. .....!.....".....$.....3.....?.....M....._...........w.................P...................................T.....s...........\.......................g.......................C.....l.................a.................N................."............ ....H ....a ..... ....$!....X!....m!.....!....C"....."....."....0#.....#.....$.....$.....$.....$.....$.....%....W%.....%.....%.....%....(&....u&.....&.....&.....'....e'.....'.....'.....(...._(.....(.....(.....(....G)....q).....).....).....*....C*....S*.....*.....+....4+....H+.....+....@,.....,.....,.....,....G-....f-....|-.....-..........7.....[............/....K/....^/...../....O0.....0.....0....&1....i1.....1.....1.....2....x2.....2.....2....B3.....3.....3.....3....g4.....4....95....R5.....5....C6.....6.....6....&7.....7.....7.....7....*8....t8.....8.....8....,9.....9.....9

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\ru.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):996315
                                                                                                                                                                                                                  Entropy (8bit):4.845331047532895
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:4I6pfQjRo4YSWPAY+zJ9LF1WAati/16HzW/yqSvDsNL4kXew+YHVeXN2hVO3j/iH:4T25H3Oc
                                                                                                                                                                                                                  MD5:E9AF20A6226511CD535888846A2BB16F
                                                                                                                                                                                                                  SHA1:739A46269F334ECC291BAE6777F0B7C8E271E4C0
                                                                                                                                                                                                                  SHA-256:5DB640C6C288D9FC79012A7670301A3BC463359C17BA200AEDAA56260EF8D955
                                                                                                                                                                                                                  SHA-512:7897C500718382F08D55F3CDDD96D1451524B5C2B8FEBC65E1700A645598B622C819EC66E4A21C119F044FAAA525A2ABDDDF66D0C9800AF6ECEA9CEB217A88BB
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(d.e.....h.....i.....j.....k.....l.....n.....o.....p.%...q.+...r.7...s.f...t.}...v.....w.....y.....z.3...|.Z...}...............................................................................$.....<.....c.....X.....$...............................................D.............................G...........0...........8.....[.................Q.....h...... ..... .....!....J!....=".....#.....#.....#....z$.....%...._%.....%....;&.....&.....'....A'.....'.....(....#)....P)....T*....N+.....+.....,.....,....0-....]-.....-............................_/...../...../.....0.....0.....1....X1....}1....#2.....2.....2...."3.....3....%4....`4....w4.....4....t5.....5.....5....B6.....6.....6.....7.....8.....8...._9.....9.....:.....:.....:.....:....T;.....;.....;.....;....|<.....=.....=.....=.....>.....?.....?.....?....|@.....@.....A.....A.....A....GB.....B.....B.....C.....C....mD.....D....jE...."F.....F.....F.....G.....H.....I....lI.....J.....J.....J.....J....xK.....K....&L....?L.....M.....M....4N

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\sk.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):626605
                                                                                                                                                                                                                  Entropy (8bit):5.815043408006658
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:6fKTvoktDh40i/igVQm5611wYZLtWTjsxt9Wl:6KTdjib5ewsPtIl
                                                                                                                                                                                                                  MD5:B0BBB6661370D27B6600EBE98CADB9AC
                                                                                                                                                                                                                  SHA1:1139852DA47048F15C16EB101DAC86DFC8F652BA
                                                                                                                                                                                                                  SHA-256:E0FE4130E668AC659D5334C5BC8CDE70BBA8742273B5965836860B5A8B1B016A
                                                                                                                                                                                                                  SHA-512:C8EAC323552F873EC088F77B8C46522387B0298B6D566CF8AA173FA9B2D66389068BB26E46044AF2FAA4224B39DC748164843B58B99E9DDE093FCB32AFB5FED0
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.:...k.I...l.T...n.\...o.a...p.n...q.t...r.....s.....t.....v.....w.'...y.N...z.|...|.....}.....................................!.....(...../.....0.....1.....3.....G.....O.....a.....v.....2...........N.....l...........M.................'.........................................6.................4.....G.................).....=.................K.....p.............................z ..... ....,!....E!.....!....("....^"....o"....."....v#.....#.....#....d$.....$....B%....]%.....%.....&....3&....H&.....&.....'..../'....A'.....'.....(....)(....;(.....(.....)....Y)....o).....)....L*.....*.....*.....*....X+.....+.....+.....+....u,.....,.....,.....-.....-.....-.....-....s...........D/....\/...../...../.....0....+0.....0.....0.....0.....1.....1.....1.....2....#2.....2.... 3....e3.....3.....3....C4...._4....t4.....4....R5....y5.....5.....6.....6.....6.....6.....7.....8.....8.....8.....9.....9.....9.....9....O:.....:.....:.....:....L;.....;.....;.....;...._<.....<.....=

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\sl.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):601837
                                                                                                                                                                                                                  Entropy (8bit):5.489524001909229
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:mZ9VfcB2z/i1SE5vqfCWJU171i/fzSjqc:mHVBWSE5vqfmi/fzSl
                                                                                                                                                                                                                  MD5:AA7C0F35B61A230D65E498DAAB67388C
                                                                                                                                                                                                                  SHA1:F60CB1C7128A1FB1CFD9AA029F96DF36033777D0
                                                                                                                                                                                                                  SHA-256:03AFC83CDBA98C08AF169C8AE111AA916F3EE6D5A2FEE4954EF35ECC063F2B21
                                                                                                                                                                                                                  SHA-512:048D03C490F18D22F4900363F9C4ABEE037A2029F226C90806064FFEDC85B07A1D86225B9C534311B08F588632A84221D7E4FA355E7B768CFDFD6102C5FFE705
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k."...l.-...n.5...o.:...p.G...q.M...r.Y...s.....t.....v.....w.....y.'...z.U...|.|...}...............................................................................,.....<.....O...........n.................J...................................N.....m...........9.....m.................8.....c.....p...........+.....V.....e...........G.....|........... .......................]............ ..... ..... ..... ....%!....9!.....!....3"....j"....."....$#.....#.....#.....$....v$.....$.....$.....$....T%.....%.....%.....%....?&.....&.....&.....&....K'.....'.....'.....(....n(.....(.....).....).....).....)....;*....P*.....*.....+....:+....M+.....+.....,....B,....Q,.....,....,-....i-.....-.....-....8.....X.....p............/....;/....V/...../.....0....\0....n0.....0....O1.....1.....1.....2....l2.....2.....2.....3....x3.....3.....3....34.....4.....4.....4.....5..../6.....6.....6....j7.....7....@8....}8.....8....T9.....9.....9.....9....;:....Y:....i:.....:....I;.....;

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\sr.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):924863
                                                                                                                                                                                                                  Entropy (8bit):4.7696519516761695
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:nP3ydDCzsexx7UinNLQIlApSld7vwFi4CBaAwH5YvTEquCxa4F37nyIzy/k/S:P3G2zBTfWt5suBr
                                                                                                                                                                                                                  MD5:ABDD9EB966D915C1896B31CBA0B2656B
                                                                                                                                                                                                                  SHA1:CB0080E5F2C168CD0F3EDC6ED6C47734FFD67790
                                                                                                                                                                                                                  SHA-256:3913D3BE5016CE873AC68AF376D5FCF558BB5F5F29A9BC56DF0099BA47E52486
                                                                                                                                                                                                                  SHA-512:BCB258D6DA766BB6F00DFDBB03BC878000D9CF28B2B707375CE52485DB9C530A34D1528A1473F09B5765BC57ABD847F191BDE55646EB707443CD0E40509B70E1
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e. ...h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...q.....r.....s.....t.....v.....w.2...y.Y...z.....|.....}...............................%.....,.....3.....:.....;.....<.....>.....h................................... .....R.................#.....F.....A.............................M.......................) ....| ..... ....(!.....!.....!.....!....."....b#.....#.....#.....$.....%....=&.....&....C'.....'....B(....k(....').....).... *....E*....++.....+....b,.....,.....-....y....../....V/...../....V0.....0.....0....B1.....1.....1.....2.....2.....3....G3....f3....*4.....4....+5....V5.....5.....6.....6.....6.....7.....8....Q8....l8.....9.....9.....9.....9.....:.....;....n;.....;....[<.....=.....=.....=....E>.....>.....>.....?.....?....%@....^@.....@....EA.....A....$B....AB.....C.....C.....D....\D.....D....eE.....E.....E.....F.....G....lG.....G....xH.....H....yI.....I.....J....fK.....K.....L.....M.....M....!N....kN....%O.....O.....P....%P.....P.... Q....XQ....uQ....FR.....R....[S

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\sv.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):541025
                                                                                                                                                                                                                  Entropy (8bit):5.5401177610527155
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:MnZyPzw0uHrwiTR91Q0Z4IoogVChcxorsl6hI+vRFcz5RtGl2KYF4bkvMrOSOgfm:i8U7DTC0Z4KhJW5krMTMo
                                                                                                                                                                                                                  MD5:CC0806219798E3ADE0437219457A37AB
                                                                                                                                                                                                                  SHA1:DD6BA47E14B7B0D08159FBCA2409B013DC2E17DE
                                                                                                                                                                                                                  SHA-256:79A7260C8651FF3024E21F9263543BF4E9D5F3574E81CF96EDF6388F8DA85CD1
                                                                                                                                                                                                                  SHA-512:DF3DA02BB2FECBBAF1AB80AF8EF8B1A7AE9F6C7ED01F94C5A502720376924132C344DD716FC5B4DDC03733A6C3581ED8D8A577154C619BA85C527DC67F4A48C2
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........p(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.8...t.O...v.....w.....y.....z.....|.,...}.]...........................................................................................................Y.....o...........B.........................................e.......................r.......................r...................................1.....Q...........?.......................].................. ....x ..... ..... ....E!.....!....."....#"....."....N#.....#.....#.....$....n$.....$.....$.....$....O%....t%.....%.....%....-&....S&....b&.....&....2'....i'....{'.....'....6(....d(....s(.....(....()....S)....b).....).....*....C*....S*.....*.....+....H+....W+.....+....*,....e,....z,.....,....%-....E-....^-.....-.....-..........1.....}.......................u/...../.....0....D0.....0.....0.....1....-1.....1.....1.....2....&2.....2.....2.....3....03.....3....44.....4.....4.....5.....5.....5.....5....W6.....6.....6.....6....F7.....7.....7.....7.....8.....8.....8

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\sw.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):570564
                                                                                                                                                                                                                  Entropy (8bit):5.341574755821131
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:Evzozr9Cpdjcu25KmedqrCBfRdpG5PbQW49qx2FRyl+Y4jNUkCarOg6jP5AuNskZ:Evk3v15zsI
                                                                                                                                                                                                                  MD5:A63EF2C4676DFBEE98E29A84A7AD9D27
                                                                                                                                                                                                                  SHA1:2F0F4B33ACF5E63F3159C62C74DEAA9A361203F4
                                                                                                                                                                                                                  SHA-256:7B8C51B247DEA72D68CB0EF4292800C13209DA6F859A9AD289C996582F19E65C
                                                                                                                                                                                                                  SHA-512:CD65FD2C49D35757DE648F21DEC748FB4A1D13D2308552774FE9C859AD5748B21F5DB449F8B380520F27DC868A3EBAAFD58D4C45ABA34033785777D342E17E6F
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.!...j.-...k.<...l.G...n.O...o.T...p.a...q.g...r.s...s.....t.....v.....w.....y.A...z.o...|.....}.................................................".....#.....$.....).....;.....K....._.....v.............................U...................................L.....b.................I.....].................2.....A.......................).................*.....P...........N.................%.......................3 ..... ..... ..... ....4!.....!.....!.....!....q"....."....J#....f#.....#.....$....8$....S$.....$.....$.....%.....%....Z%.....%.....%.....%....L&.....&.....'.....'....m'.....'.....'.....(....n(.....(.....).....)....l).....).....).....)....X*.....*.....*.....*....q+.....+....",....;,.....,.....,.....-....6-.....-.....-....).....J............/....F/....V/...../....20....{0.....0.....1....N1....o1.....1.....1....02....X2....j2.....2....F3.....3.....3....04.....4.....5.....5.....5.....5....>6....[6.....6....P7.....7.....7.....8....j8.....8.....8....89.....9.....9

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\ta.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1468553
                                                                                                                                                                                                                  Entropy (8bit):4.052663401346278
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:eO7hLhGq5MLs32+5CrVKa1i55G62sRtRdutm1vYpiMy+:rdLhGoC+sBD1i554sRtRdutm1vYpiMy+
                                                                                                                                                                                                                  MD5:AA06EAD1200F01C9460399F0ABE2D54F
                                                                                                                                                                                                                  SHA1:9B852C4691209C0AE9EDF94A5DEC4B902FEC7B3E
                                                                                                                                                                                                                  SHA-256:1946D903918C57836D2F898EF93CD1D575DA1A464E358C399DFDE73EA2EF057E
                                                                                                                                                                                                                  SHA-512:6E556B962C16AEE22695D93B62B308D95B0695873FB33D13A147B3D8B6791C9599DAA6E3BF424A1897212A018AB36DD8C8214C2EB03457048C6931686BE40E04
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.F...t.]...v.....w.....y.....z.....|.:...}.k.............................................................................).....i...........e...........G.....y.............................}...... .....!.....!....D#....z$.....%....H%....I&....<'.....'.....'.....(.....).....*..../*....g+....k,.....,....V-...........0.....0....21....S2....i3.....4....O4.....5.....6....[7.....7.....8....5:.....;....d;.....<.... >.....?....m?....p@....9A.....A.....A.....B.....C.....D....<D....$E.....E....ZF.....F.....G.....H....UI.....I.....J.....K.....L....<L....*M.....N.....N.....N.....O.....P.....Q....KQ....ER....6S.....S.....S....>U.....V....kW.....W.....X.....Y.....Z....CZ....&[.....[....J\.....\....p]....Y^....$_....q_.....`.....a....+b.....b.....c....Nd.....d.....d.....f...."g.....g.....h.....i.....j....tk.....k.....m.....o.....q....Pq.....r.....s....nt.....t....Nv....tw....$x.....x.....y....vz.....z....6{....h|.....}....5~

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\te.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1359248
                                                                                                                                                                                                                  Entropy (8bit):4.307321925100967
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:RG0y8Y7McKNW0yR5D7FgpC8ybtKRT5sbvkW3p/8WffhBp3p1FPnzTitlF2iDk7Pi:RGB+s5RNHFy
                                                                                                                                                                                                                  MD5:A4ACCC25DD8A00BC57DF4FCA12E41295
                                                                                                                                                                                                                  SHA1:9466888034C9E6ECF4113DDDA63D363ED20E3156
                                                                                                                                                                                                                  SHA-256:157D646525F6A9AC267466631671E65E9B5C3E55B008B564186E64C6853E52AA
                                                                                                                                                                                                                  SHA-512:F19116655B6C2BB5C572B45F1D712FA1F9D57D9E8963FB3D654ED3781BD34A4E937B590BCC1119A318E28632DA12A0EF8B36F6426791DE833898CF7F30189567
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.:...h.B...i.\...j.h...k.w...l.....n.....o.....p.....q.....r.....s.....t.....v.)...w.U...y.|...z.....|.....}.......+.....0.....8.....@.....H.....O.....V.....].....^....._.....d.......................^.......................D.................".....q............ ..... ....6!....s".....#....+$....f$....H%.....%....D&....y&.....'....X(.....(.....)....'*.....*....l+.....+....O-....y.....E/...../.....0.....1....e2.....2.....3.....4....i5.....5.....7....C8....A9....~9.....:....d<....D=.....=.....>....:?.....?.....?.....@.....A.....B....]B....qC....6D.....D.....D....3F.....G.....G.....H....5I.....J.....J.....J.....K.....L....>M.....M.....N....nO.....O....%P....KQ.....R.....R.....R....8T.....U.....U.....V.....W.....W.....X....`X....+Y.....Y.....Y....,Z.....Z.....[....h\.....\.....].....^....._....#`....$a.....a....4b.....b.....c.....d....#e....pe.....f....sg.....h....Vh....(j.....k.....l....!m.....n.....o....op.....p....6r....#s.....s.....t.....u.....u....?v.....v.....w.....x.....y

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\th.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1142703
                                                                                                                                                                                                                  Entropy (8bit):4.350453098899463
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:X6cnN9LyZYAPTKznL/4svUSynUGevuB5Uz0dNL3fRj8NRU+wunRUdGILV+w11LAn:X05ANf
                                                                                                                                                                                                                  MD5:B18E4574DB917920ECCFB8E6900D0662
                                                                                                                                                                                                                  SHA1:554206B9E639135074B0946FB28B6FFE2D934159
                                                                                                                                                                                                                  SHA-256:C14FA1BB30C880216D6CFEA6FB738235CF72A3FE8BE919C3D61321D5A5883211
                                                                                                                                                                                                                  SHA-512:5F427F9ED85BB368B45BAFD523C634E18596E430FDC380563878D2CA897CF2580D0405F7C0D8E10ABBA389BB7125978A81D335263BB777E0EE0BFE3D47C8C65F
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........'..e.8...h.@...i.H...j.S...k.b...l.h...o.p...p.}...q.....r.....s.....t.....v.....w.6...y.]...z.....|.....}.........................$.....,.....1.....9.....@.....G.....N.....P.....U.....y.................<.....M.....$.......................`.............................h.......................]...........P............ ....> ..... ....Z!.....!.....!.....".....#.....$.....$....y%.....&.....&.....&.....'....R(.....(.....(.....)....f*.....*.....*.....+....t,.....,.....-....F.....5/...../....30.....1.....1.....1....82.....3.....3.....4....@4.....5.....5.....5.....6.....6.....7.....8....A8.....9.....9....4:....X:....$;.....;....E<....l<.....=.....=.....>..../>.....?.....?....%@....L@....fA....cB....'C....OC.....D.....D.....D.....E.....E....JF.....F.....F....hG.....G....OH.....H.....I....TJ.....J....ZK.....K....oL.....L.....L.....M....<N.....N.....N.....O....KP.....P.....Q.....R.....R.....S.....S.....U.....V.....V....$W.....X.....X....HY....xY.....Z.....Z....![....@[....I\.....].....]

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\tr.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):581275
                                                                                                                                                                                                                  Entropy (8bit):5.614415854351588
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:A9dM9N/9/UHzNsgkDQqZFtQSJ8kJ5MLJy:0eZb8kJ50Jy
                                                                                                                                                                                                                  MD5:82C6A14BA1B28F947BEE67BC3FEAB091
                                                                                                                                                                                                                  SHA1:25023B22EAED29D0817EC95D5BCB4AD3D724F5AD
                                                                                                                                                                                                                  SHA-256:099507F6F2A2C98ECCE275F8AD956EEEEAADA65B7788356301AF04A0CD7D431E
                                                                                                                                                                                                                  SHA-512:988A9275B7A05D100CA9242DD05969D2363A42938D47DB37A1F62EC1874E96B640C14B272F1829AB5C6E0D2763C22FBF0AF99894D4D9D32726925EABBC02C05E
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.-...v.b...w.....y.....z.....|.....}.;.....d.....i.....q.....y...................................................................................k.................K................. .......................Y.......................].......................D.......................N...................................3.....P............ ....G ....X ..... .....!....6!....F!.....!....2"....u".....".....#.....#.....#.....#....D$.....$.....$.....$....D%.....%.....%.....%....A&.....&.....&.....&....A'.....'.....'.....'....T(.....(.....(.....)....b).....).....).....*...._*.....*.....*.....*....\+.....+.....+.....+.....,.....-....R-....k-.....-....1.....^.....z...........$/....F/....a/...../.....0....C0....U0.....0....,1....f1.....1.....1....52....T2....d2.....2....(3....S3....h3.....3....<4.....4.....4....C5.....5....[6....m6.....6....r7.....7.....7....o8.....8....)9....E9.....9.....:....9:....N:.....:....';....`;

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\uk.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):996487
                                                                                                                                                                                                                  Entropy (8bit):4.873979205850633
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:1x/vKIH9mGGHWK9TddsSr+whF5gZrZEdIIXgOb5YB3Ijwl2Ab+rUcauHLNiXErqx:3/vXH9ynh5BrI
                                                                                                                                                                                                                  MD5:EC3AA18A9D9C989B1025DDDB0FA52B55
                                                                                                                                                                                                                  SHA1:AB3B0834CABEE34BC2F9FD04104B10E5F9C102CA
                                                                                                                                                                                                                  SHA-256:EE67744C26E0C69FBED8B102ADD339070AABC70C2D8CA9EA037C6C9D23B66D3B
                                                                                                                                                                                                                  SHA-512:90D40424B050C6C7ACE113E85B0B0A58472967C50A14FBC6637CD3B2DB8FF3F521CC94DCD256FA017684256E8A9C19B158AAA57F6D3094FAB970578D3B1C6847
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........[(..e.t...h.|...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.Z...w.....y.....z.....|.....}.3.....\.....a.....i.....q.....y...........................................................7....."...........x...........\...........b...........W.............................&.................q...........X.....}...... ..... .....!.....!.....!....f".....".....".....#.....$....'%....c%.....&.....&.....'....5'.....'....t(.....(.....(.....)....a*.....*.....*.....+.....,....8-....r-..........k.................\/...../.....0....90.....0....81....v1.....1....H2.....2....F3....m3.....4.....4.....4.....4.....5.....6....R6....k6.....6....z7.....7.....7....n8.....8....<9....W9....P:.... ;.....;.....;....}<.....<....A=....c=.....=....9>....b>.....>....5?.....?....T@....o@....dA.....B.....B.....C.....C.....D....<D....iD.....E.....E.....E.....F.....F....]G.....G.....H.....H.....I....hJ.....J....wK....;L.....L.....M.....M....DN.....N.....N....EO.....O.....P.....P.....P.....Q.....R

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\ur.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):870809
                                                                                                                                                                                                                  Entropy (8bit):5.161712117251234
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:wtiyilnG/Uo458PMzCR4FXdQLN9AyTibR45GO6EhTCWORJlbQYrMYVwadcJKwURn:Vyie5T5/Cgu
                                                                                                                                                                                                                  MD5:CB228CC41981E8BCBD2768DA20026912
                                                                                                                                                                                                                  SHA1:C55BB999C4C1FBEE5E38B6C986FBCE2B128F3880
                                                                                                                                                                                                                  SHA-256:A7D825FE348700528800EF9EA7940EE8027373E9C05A4E51E526D0A213C05429
                                                                                                                                                                                                                  SHA-512:85308806BE53494683F32520E181DD9C8C9ABAC0B92BC439D4E30EEF22D4AF993794A9719DD9A4EEED0BBCAF61C0E2342E7D4ED5D30B504572BD2BC269100E2E
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.!...l.,...n.4...o.9...p.F...q.L...r.X...s.....t.....v.....w.....y.&...z.T...|.{...}.........................................................................&.....@.....^...........Z.......................w.....!.......................G.......................N.................k...........7.....X...........g ..... ..... ....d!.....!....%"....R".....#.....#.....$....Q$.....$.....%.....%.....&.....&....L'.....'.....'.....(....W).....).....*.....*.....+....7,....h,.....,....H-.....-.....-....+.......................q/...../.....0....90.....0....Z1.....1.....1....a2.....2....A3...._3.....3....j4.....4.....4....U5.....5.....6....)6.....6....47.....7.....7....d8.....9.....9.....9....Q:.....:.....;....=;.....;.....<....K<....y<.....=.....=.....=.....=.....>....@?.....?.....?....x@.....@....%A....HA.....A.....B.....B.....B.....C....GD.....D.....D.....E....xF.....F....!G.....H.....H....-I....lI....7J.....J....4K....bK.....K....qL.....L.....L.....M.....N....oN

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\vi.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):689415
                                                                                                                                                                                                                  Entropy (8bit):5.7905904014606335
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:v8/9MO+cGZoEK9VaZLlFK0FgxBxJbTsIxvx5a8h/9cDNUOnmzi0HRva8Z1lc:vSSO+cG6V4lE0uxHZH5a899yiOnwi01k
                                                                                                                                                                                                                  MD5:045241A62232BAE57F1D57C6C3AF7C55
                                                                                                                                                                                                                  SHA1:5C2A1A677A8BDFA20F3577335131BD4B89A46355
                                                                                                                                                                                                                  SHA-256:56758C918BBFE6A9D5B20E8B4A7248BDF2D43E0BF5F98E85A9892FF03DBC2D99
                                                                                                                                                                                                                  SHA-512:8E30AF44A53A36A194DA16A756DFF0F90EFBEF164277BDCDE683C89A3CDC04AE5E1298475E8A098D19DAB73EB0A71637F676D49D237C5480E1F7ACA1765166BB
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........P(..e.^...h.f...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.M...w.y...y.....z.....|.....}.&.....O.....T.....\.....d.....l.....s.....z...........................................................O.................r...........G.....^.......................*...........+.....}.................?.....e.....q...........G.................2.............................. .....!.....!.....!....?"....."....."..../#.....#.....#.....$.....$....;%.....%.....%....t&.....'....q'.....'.....(....o(.....(.....(....').....).....).....)....B*.....*.....*.....*.....+.....+....E,....\,.....,....2-....i-....z-.....-....D.....x.................Q/...../...../.....0....v0.....0.....0....r1.....2....x2.....2.....3.....3.....3.....3....V4.....4.....4...._5.....5.....6....+6.....6....h7.....7.....8.....8.....9....89....Z9.....9....W:.....:.....:....N;.....;.....<....+<.....<....s=.....=.....=.....>....Y?.....?.....?....u@.....@.....A....,A.....A.....A....2B....FB.....B....xC.....C.....C

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\zh-CN.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):496499
                                                                                                                                                                                                                  Entropy (8bit):6.685741162993645
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:rr0PPN0s9IHFKwowzwAEM7i56Ez2bHy1t59Lo3/4oT2Paq8lc:XGNXUKwTzwx956Ez2bH05Nov4oTUV
                                                                                                                                                                                                                  MD5:798BC7D8B63906C5B1C67E89AD17DC58
                                                                                                                                                                                                                  SHA1:B39C86D6D3FD9D8B8DA90D86F827A0C0803FBA8C
                                                                                                                                                                                                                  SHA-256:1C05280D8DCDFE99619695B76DD054292A90C1A93A5CFB92CDC4A5B0068A7092
                                                                                                                                                                                                                  SHA-512:7A21AF438823D562B889D7C99F639421E01F0536E95F3206DD53D2C8DED82B7A4AB74BB9B4262B2FA27E50EFD8DD7719827AD2E6B6D4C2E0D0811930027ED982
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(U.e.....h.....i.....j.....k.+...l.2...m.:...o.a...p.f...q.l...r.x...s.....t.....v.....w.....|.F...}.w.........................................................................................%...........6.......................U.......................\.......................e.......................d......................./.....V.....c.................6.....P...........+.....l.....~...........:.....n.....{........... .....I.....U.................;.....M..........." ....` ....r ..... .....!.....!....5!.....!.....!.....!.....!....D"....."....."....."....!#.....#.....#.....#....)$....{$.....$.....$.....%....a%.....%.....%.....%....?&....g&....s&.....&.....'....A'....M'.....'....3(....t(.....(.....(....#)....C)....W).....).....)....$*....;*.....*.....*.....+....(+.....+.....+.....,....),....u,.....,.....,.....,....E-.....-.....-.....-....E.......................a/...../.....0....,0.....0.....0....01....E1.....1.....1.....2....*2....v2.....2.....2.....2....H3.....3.....3.....3....D4

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\locales\zh-TW.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):491017
                                                                                                                                                                                                                  Entropy (8bit):6.696102855635661
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:IpP3caOCTyemy5JPFW2uHu4u0JU52UznMi4LnKeze9Tk:qXvmOWzu0JU52UznUeC
                                                                                                                                                                                                                  MD5:0BE25A48EECEE48F428FE56FBFA683FD
                                                                                                                                                                                                                  SHA1:94C0E8C99BEB592EBAB9EA5B8758AA414BBE7048
                                                                                                                                                                                                                  SHA-256:A5E276BDFE4CF87832EEE153596CCDE9CF9193E81F29A4295C8335525DA64295
                                                                                                                                                                                                                  SHA-512:423033E67654820AB9F9773F45F70908511AEB8228C59126757885E0BBE0BD960257324D405D27526D61B541B1E6323DE16BEF29D4DCB94F39FD5E92FA811CC8
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........'..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.&...v.[...w.....y.....z.....|.....}.4.....].....b.....j.....r.....y.....................................................8.......................T.......................@.......................<.......................$.....y.......................J.....k.....x...........(.....N.....h...........%.....T.....i.................J.....W.................(.....4................./.....A.................W.....i.................. ..... ....g ..... ..... ..... ..../!....~!.....!.....!....."....X"....."....."....."....5#....^#....j#.....#.....$....M$....Y$.....$.....$....'%....0%.....%.....%.....&.....&....t&.....&.....'.....'....j'.....'.....'.....'....0(....v(.....(.....(....J)....t).....).....)....3*....d*.....*.....*.....+....!+....-+.....+.....+.....+.....,....s,.....,.....,.....-....|-.....-....=.....L............/....S/....h/...../.....0....G0....S0.....0.....0.....0.....0....M1.....1.....1.....1....=2.....2

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):5755390
                                                                                                                                                                                                                  Entropy (8bit):7.996220000544904
                                                                                                                                                                                                                  Encrypted:true
                                                                                                                                                                                                                  SSDEEP:98304:JZ5ti6+nkrht455GGPeenn0mJSwLEpxIvMi8rwrGU3nAaqdkmYAzFKwR4:j7ilnkrP455GGHnhEXU8kr1Xqdf1FvG
                                                                                                                                                                                                                  MD5:6772B597BF68622D934F207570E771B1
                                                                                                                                                                                                                  SHA1:F2A80FBFA034CB1FA07DC9AA37BF9F5B2280FF13
                                                                                                                                                                                                                  SHA-256:268DE4D99AB7C4F4EE32C8E8CB2B058A2C8D0D839F468AE8E8C0605FEAA736EA
                                                                                                                                                                                                                  SHA-512:A2BE67DF09951C9EF9200DCCCBDFF13736921522191F0001DA539D5C7F26B5B26A6B810BE6963908F216768C98D21E52486C7E00538CC0730E8C78E78811B85B
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:............f..#..{.V...|.*1..~..4....OG....aI................V...........@..............................................D9....Dc....D.....D.....D.....D.....D,....D" ...D*$...D.$..HE.$..IE.(..JEx*..SE-/..TE.8..UE.G..VE.h..\E.q..]E.r..^E.s..`E*t..aEty..bE....cExo..dE.Z..eE.[...E.\...E.m...Eho...Exs...E.u...E.{...E.....E....E.....E.....E[....E....EV....E.....E.....E7....E.....E.....E2....E.....L9....L.....L.....L+....LP....L.....L(.../Lo...0L5...1L,)..2L.3...Q.D...Q.P...QdY...Q.\...Q._...Q.j...Q.k...Q.l...QAn...Q.....Q.....R.....R....ZdA&..[d"(..\d:=..]d.@..^dpA.._d3D..`d.G..adqI...d.T...d.Y...d._...d.m...d.p...dUu...d.v...d.x...d.y...d.|...d;....d....6eL...7e|...8e...9e5...:e....;e....<e....=e....>e#...?e....@eo...Ae....Be=...Cex....gp....ga0...g.2.....3.....6.....*....X+.....2.....2.....4.....9.....L....K...........a.....g.....9.....Y.................7... .>...<..L..=..M..>..S..?..X..@.cZ..B.]g..C..i..D..s..E..v..F..w..G.i...H.....I.....J.....K.]...L.....M.....N.S...O._...P.L...Q...

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):11930142
                                                                                                                                                                                                                  Entropy (8bit):6.847206908090126
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:98304:yM8gj5wrFTmZ1pQGzpEQTEbFSTc99qkx/vAb2cWd:yq5wrFTmZ1pQGzpEQyYcntIb2cs
                                                                                                                                                                                                                  MD5:BF21190C5B7B182913A55B087E3E00EF
                                                                                                                                                                                                                  SHA1:F7F1C4C7894E998193EA81EF342491AF2C4A73DF
                                                                                                                                                                                                                  SHA-256:F990DCB80D680180E661B1281F5BA19959011E355CB0C5B40801790912D83503
                                                                                                                                                                                                                  SHA-512:0805256B05A2CBA20F8C27776E973A6AC0160D28E7BA570CF94852DB9F4B5111CB19BE8272E9BF37E0A7BCA3B9430CD7C39467CECE91B562B6336E7154D8E9B4
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:....P...L...G...{"files":{"node_modules":{"files":{"@babel":{"files":{"generator":{"files":{"LICENSE":{"size":1106,"integrity":{"algorithm":"SHA256","hash":"117da2af0d4ce0fe1c8e19b5cff9dcd806adf973d328d27b11d4448c4ff24f76","blockSize":4194304,"blocks":["117da2af0d4ce0fe1c8e19b5cff9dcd806adf973d328d27b11d4448c4ff24f76"]},"offset":"0"},"lib":{"files":{"buffer.js":{"size":5771,"integrity":{"algorithm":"SHA256","hash":"49d70448373ee7293d57c661383f44e86174059be60d2f8fb98969ae97f16e5e","blockSize":4194304,"blocks":["49d70448373ee7293d57c661383f44e86174059be60d2f8fb98969ae97f16e5e"]},"offset":"1106"},"generators":{"files":{"base.js":{"size":2294,"integrity":{"algorithm":"SHA256","hash":"fb4891bbcaf0f27846b193500bc944213e7cbf2c0feb282795b153d70282e000","blockSize":4194304,"blocks":["fb4891bbcaf0f27846b193500bc944213e7cbf2c0feb282795b153d70282e000"]},"offset":"6877"},"classes.js":{"size":4157,"integrity":{"algorithm":"SHA256","hash":"7f9a3208c888e8ef986bf7cb79a5143fd8bb51308ca17bad9e0a5be0c5251

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\index.js

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:Java source, ASCII text
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):4000
                                                                                                                                                                                                                  Entropy (8bit):5.348928984866719
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:96:umC8wdGAK449W7zAaTkSZPXRS/hLfFBZ8tAemaPe6QaiiFVlPXRYaPJyPXCRy04:93/Gbk4BS5fFL82emJaii/hBLPkXCRyR
                                                                                                                                                                                                                  MD5:884E837BDA065828A42D633F81CDFAD5
                                                                                                                                                                                                                  SHA1:C1768675091EA6139B90E53853420CCEF9C09A4C
                                                                                                                                                                                                                  SHA-256:B7AC5FA0D24DF44755481B9876850FED593423D68C48EED9D30E989879B1864B
                                                                                                                                                                                                                  SHA-512:A43BD95B227BA0158A0005A9BFEC6DFDD3AD1CD85BCFBAF37681A7664B4D66E834BDD33484251374F791B5A5D7CBE2DC5CB26BAF0E029712F8977CB5509B9852
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:import process from 'node:process';.import {promisify} from 'node:util';.import path from 'node:path';.import {fileURLToPath} from 'node:url';.import childProcess from 'node:child_process';..const __dirname = path.dirname(fileURLToPath(import.meta.url));..const TEN_MEGABYTES = 1000 * 1000 * 10;.const execFile = promisify(childProcess.execFile);..const windows = async () => {..// Source: https://github.com/MarkTiedemann/fastlist..let binary;..switch (process.arch) {...case 'x64':....binary = 'fastlist-0.3.0-x64.exe';....break;...case 'ia32':....binary = 'fastlist-0.3.0-x86.exe';....break;...default:....throw new Error(`Unsupported architecture: ${process.arch}`);..}...const binaryPath = path.join(__dirname, 'vendor', binary);..const {stdout} = await execFile(binaryPath, {...maxBuffer: TEN_MEGABYTES,...windowsHide: true,..});...return stdout....trim()....split('\r\n')....map(line => line.split('\t'))....map(([pid, ppid, name]) => ({....pid: Number.parseInt(pid, 10),....ppid: Number.parse

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\license

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (460)
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1117
                                                                                                                                                                                                                  Entropy (8bit):5.079903213409815
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24:FHr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:FH8JplPvEDvQHcs5ITc3omFD
                                                                                                                                                                                                                  MD5:D5F2A6DD0192DCC7C833E50BB9017337
                                                                                                                                                                                                                  SHA1:80674912E3033BE358331910BA27D5812369C2FC
                                                                                                                                                                                                                  SHA-256:5C932D88256B4AB958F64A856FA48E8BD1F55BC1D96B8149C65689E0C61789D3
                                                                                                                                                                                                                  SHA-512:D1F336FF272BC6B96DC9A04A7D0EF8F02936DD594F514060340478EE575FE01D55FC7A174DF5814A4FAF72C8462B012998ECA7BB898E3F9A3E87205FB9135AF2
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\package.json

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):606
                                                                                                                                                                                                                  Entropy (8bit):4.677493590111802
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12:/r1JPknYwUj+T4SHtGwwnH/h6lGP9pek/GacG1GOcIretJYM+ROA:z1JmUrS0JH/hRrsOreJA
                                                                                                                                                                                                                  MD5:0D66A224C9A1C343842B7C97E5634EA6
                                                                                                                                                                                                                  SHA1:83E8A14CFACEB5A522E91F057CB76FA98162F9A7
                                                                                                                                                                                                                  SHA-256:B7A7AF79AE2225F7DEE5B160559468EFC4663CF8DFD2C6E9A068969CB089B003
                                                                                                                                                                                                                  SHA-512:E071F659C7C433B55F0F1AED83AE63032618E522D11077DA83E32D9ED072A20B123CB8083129DF7201DD19BCB1D578D87EF256659B74D9E82A0934B725957F38
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:{. "name": "ps-list",. "version": "8.1.1",. "description": "Get running processes",. "license": "MIT",. "repository": "sindresorhus/ps-list",. "funding": "https://github.com/sponsors/sindresorhus",. "author": {. "name": "Sindre Sorhus",. "email": "sindresorhus@gmail.com",. "url": "https://sindresorhus.com". },. "type": "module",. "exports": "./index.js",. "engines": {. "node": "^12.20.0 || ^14.13.1 || >=16.0.0". },. "files": [. "index.js",. "index.d.ts",. "vendor/*.exe". ],. "devDependencies": {. "ava": "^3.15.0",. "tsd": "^0.18.0",. "xo": "^0.46.4". }.}

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):271872
                                                                                                                                                                                                                  Entropy (8bit):6.267941112452071
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:JxxmnATc41sT3iVSd87fqCHeohyRDaFsIh:3xmnz41s+VSsfT+o
                                                                                                                                                                                                                  MD5:F92F454DE8ECEDD3945DBAEACD381DC3
                                                                                                                                                                                                                  SHA1:ED4AA49E15795AC31F1E7CFAEF2E0C16359C5258
                                                                                                                                                                                                                  SHA-256:D1A71F9AC1728082C1B276392725C3E010B98714888579B99152E401ABEDBF11
                                                                                                                                                                                                                  SHA-512:312D62DA1F41E2B9FE0F15EF30D81A4241F309D83A24643EC8CB99104EF5EF7F52EC216C5CDF0E3995FC5B538DFDFC54E78FBDE3A57EB0AB8BD04DEC07CB5586
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h...,.n.,.n.,.n.w.m.&.n.w.j.>.n.w.k..n...j.<.n...m.&.n...k.}.n.w.o.).n.,.o.L.n..g.-.n....-.n..l.-.n.Rich,.n.........................PE..d......^..........".................D..........@..........................................`.....................................................(....`....... ...#...........p..,.......p..............................0............................................text...\........................... ..`.rdata...I.......J..................@..@.data....*..........................@....pdata...#... ...$..................@..@_RDATA.......P......................@..@.rsrc........`......................@..@.reloc..,....p......................@..B................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exe

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):215040
                                                                                                                                                                                                                  Entropy (8bit):6.5588154485327355
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:MuP738wut5T2/efnO310+Hfd+ueCuMvMLAOgp+HQ:MuPL8wut5T2/eCHF+ueCQeQHQ
                                                                                                                                                                                                                  MD5:3DE9EE7FE8CF4710DA1C8538A1BD86DF
                                                                                                                                                                                                                  SHA1:6FF4B813AD66F0B013222FE044579511A79804D8
                                                                                                                                                                                                                  SHA-256:017411F3B0B5C0402CC3B2CB87C32C6FC71ABD82E5B17EA6108990096C75A65D
                                                                                                                                                                                                                  SHA-512:0AAB4D484DF289485BEB90EE8B7D929D2D6FA5D7E4385C17B2745DEA40E295F1A9C6C3C8C6C206B46F04A50B51EB01952793FFB84E978C9D0D7447435280ABE7
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HY..)7..)7..)7.A4..)7.A2.Z)7.A3..)7.4F3..)7.4F4..)7.4F2.)7.A6..)7..)6.)7.yY>..)7.yY...)7.yY5..)7.Rich.)7.................PE..L......^.................$.........."z.......@....@.......................................@.................................L$..(....P.......................`... ......p...........................P...@............@..@............................text....".......$.................. ..`.rdata.......@.......(..............@..@.data........0......................@....rsrc........P.......$..............@..@.reloc... ...`..."...&..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\resources\elevate.exe

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):107520
                                                                                                                                                                                                                  Entropy (8bit):6.442687067441468
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
                                                                                                                                                                                                                  MD5:792B92C8AD13C46F27C7CED0810694DF
                                                                                                                                                                                                                  SHA1:D8D449B92DE20A57DF722DF46435BA4553ECC802
                                                                                                                                                                                                                  SHA-256:9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
                                                                                                                                                                                                                  SHA-512:6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\snapshot_blob.bin

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):316538
                                                                                                                                                                                                                  Entropy (8bit):4.177181507694743
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:p+JfFRciefJNlUMX2kIE1aOaVsS/3hYeFWYSITdJgClE+ceNTbM:pefPciePmMXh1aOCsy3hpFRlzVw
                                                                                                                                                                                                                  MD5:C8950B01F336B05609976546B1A007E6
                                                                                                                                                                                                                  SHA1:F04D0B0369007BBE6A7FE129B31B19DD1822F32F
                                                                                                                                                                                                                  SHA-256:9B3A75A713E41BC73F219858FCAC8E3031BA22732285ED3A64DC48074C725CC2
                                                                                                                                                                                                                  SHA-512:B7DB4277290E849A52AD5D31FF65AB5D2B75C2125D67EEEE02B09E4E7001AA46D10BF89429C65695C7560D1C45B898C20275EB9E36CD8B259707FFB8B298F103
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:..........(.._.13.0.245.16-electron.0..........................................`L..............l....K..}.a........a........a2.......aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\v8_context_snapshot.bin

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):687473
                                                                                                                                                                                                                  Entropy (8bit):5.155441647860749
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:vPYRCOn2E6keR1PciePmMXh1aOCsy3hbHRlEDMrVkSiF01gwoHZHCvqmO9iXz8pk:vPY5nnbe3WZBr/iXo73nVE+2l
                                                                                                                                                                                                                  MD5:BF2976DA5086B48D74EB36F56F5DEB83
                                                                                                                                                                                                                  SHA1:5AA7669A3E2166FDD7534241A0E7A9BD3FF5748B
                                                                                                                                                                                                                  SHA-256:9F1614328E18BECB4ADF96DE98BC91CE2A69274ABE6621327CC0FC8503A1AB20
                                                                                                                                                                                                                  SHA-512:C44DEEB96597B4498604ECF2060EE0520E84A00308CA1F47FFDF8E3ED3E676B27B622FF7DBD4B6F1A14CE60B05CC2AD9B8D7562BB362C1B12A885EA7FBE50E0A
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:...........a.na.13.0.245.16-electron.0..............................................!...i...1...q.......l...x...}.a........a........a........aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\vk_swiftshader.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):5533184
                                                                                                                                                                                                                  Entropy (8bit):6.341413194477468
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:49152:zBVtMrKyOsxYYAKDsJS86IxORjgUlC3K/FAz4gdm6o4oX7uh5LC6MW4LY67h772c:jWKyOEnOnoLrWbfDiN9isC
                                                                                                                                                                                                                  MD5:6720D5DCDA6737EB0CC5A352A47414DC
                                                                                                                                                                                                                  SHA1:03D9A8E350F485DD955F7DEE06BFC46371753032
                                                                                                                                                                                                                  SHA-256:D8F36B089D83157ABC271D9FE125919C3237943FA9789A511AC5EF1D41E2E3AF
                                                                                                                                                                                                                  SHA-512:DE5ADE6CE14B14957FCE669C4181AF1E6A6F540798D1C6720B56FF281F813A6CE4446BDE33A8F175D2484E07F4911F93A773CAC1D372CBE3B26BE634B3FA1686
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......B.........P.;.......................................U...........`A..........................................O.......O.P....PU.......S..W...........`U.......O......................O.(.....B.@.............P.8............................text...g.B.......B................. ..`.rdata........B.......B.............@..@.data...H.....P.......P.............@....pdata...W....S..X...VR.............@..@.gxfg...0.....T..0....S.............@..@.retplne..... U.......S..................tls....Y....0U.......S.............@..._RDATA.......@U.......S.............@..@.rsrc........PU.......S.............@..@.reloc.......`U.......S.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\vk_swiftshader_icd.json

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):106
                                                                                                                                                                                                                  Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                  MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                  SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                  SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                  SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\7z-out\vulkan-1.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):894976
                                                                                                                                                                                                                  Entropy (8bit):6.60309283089771
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24576:FhJnfYUcguY3cTAL6Z5WjDYsHy6g3P0zAk7TNb:FhVrXN3oAL6Z5WjDYsHy6g3P0zAk7T
                                                                                                                                                                                                                  MD5:B6D3AF84E8BE0027741AA6077768789E
                                                                                                                                                                                                                  SHA1:E525F2434DC56F79644695F5841E91DD5F80EEC4
                                                                                                                                                                                                                  SHA-256:376FF6892EC7B406ACD8C455AC82F8541E59E3757195488FF04CD9F20D554562
                                                                                                                                                                                                                  SHA-512:F03B8792A740679C8A1A8CE0615B7876CC811130085F3FFB42182E0CB846519603804DA97FC93A8ABEBEE01E03FD257DF289C54575DA8FAAAD018F4F4BAE606A
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .........................................................@............`A........................................PL..<!...m..P.... .......P..ha...........0..$....:.......................9..(.......@............q...............................text............................... ..`.rdata..............................@..@.data....L......."..................@....pdata..ha...P...b..................@..@.gxfg....%.......&...j..............@..@.retplne.................................tls................................@..._RDATA..............................@..@.rsrc........ ......................@..@.reloc..$....0......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\SpiderBanner.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):9216
                                                                                                                                                                                                                  Entropy (8bit):5.5347224014600345
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
                                                                                                                                                                                                                  MD5:17309E33B596BA3A5693B4D3E85CF8D7
                                                                                                                                                                                                                  SHA1:7D361836CF53DF42021C7F2B148AEC9458818C01
                                                                                                                                                                                                                  SHA-256:996A259E53CA18B89EC36D038C40148957C978C0FD600A268497D4C92F882A93
                                                                                                                                                                                                                  SHA-512:1ABAC3CE4F2D5E4A635162E16CF9125E059BA1539F70086C2D71CD00D41A6E2A54D468E6F37792E55A822D7082FB388B8DFECC79B59226BBB047B7D28D44D298
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../../../..Wy./../../....../..Wi./..Wx./..W~./..W{./..Rich./..................PE..L...T{mW...........!................p!.......0...............................p............@..........................5..o...l1..P....P.......................`.......................................................0...............................text............................... ..`.rdata.......0......................@..@.data........@......................@....rsrc........P......................@..@.reloc..d....`....... ..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\StdUtils.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):102400
                                                                                                                                                                                                                  Entropy (8bit):6.729923587623207
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
                                                                                                                                                                                                                  MD5:C6A6E03F77C313B267498515488C5740
                                                                                                                                                                                                                  SHA1:3D49FC2784B9450962ED6B82B46E9C3C957D7C15
                                                                                                                                                                                                                  SHA-256:B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
                                                                                                                                                                                                                  SHA-512:9870C5879F7B72836805088079AD5BBAFCB59FC3D9127F2160D4EC3D6E88D3CC8EBE5A9F5D20A4720FE6407C1336EF10F33B2B9621BC587E930D4CBACF337803
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q....C...C...C...C...C...C...C...C...C...C...C...C...C.[.C...C.[.C...C.[.C...C.[.C...CRich...C........................PE..L...I..[...........!.....*...b...............@.......................................+....@..........................}..d....t..........X............................................................................@...............................text....).......*.................. ..`.rdata..TC...@...D..................@..@.data...l............r..............@....rsrc...X............x..............@..@.reloc..j............~..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\System.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):12288
                                                                                                                                                                                                                  Entropy (8bit):5.719859767584478
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
                                                                                                                                                                                                                  MD5:0D7AD4F45DC6F5AA87F606D0331C6901
                                                                                                                                                                                                                  SHA1:48DF0911F0484CBE2A8CDD5362140B63C41EE457
                                                                                                                                                                                                                  SHA-256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
                                                                                                                                                                                                                  SHA-512:C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\app-64.7z

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:7-zip archive data, version 0.4
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):86114694
                                                                                                                                                                                                                  Entropy (8bit):7.999996367170192
                                                                                                                                                                                                                  Encrypted:true
                                                                                                                                                                                                                  SSDEEP:1572864:c2/ebAbWkGYFLlAfoabh+XJhXhQiB1dJdYVkq7U9GOWwMMArXPWEWy/S:+0bEYhlAQOh01VJY+qw9dxQXPzl/S
                                                                                                                                                                                                                  MD5:2E5FD8EB58C34AE5022D72F5537AA9AE
                                                                                                                                                                                                                  SHA1:713C1FD019598B8FA4E3DB84EA24A87F6F7A20FD
                                                                                                                                                                                                                  SHA-256:68CC9F4E29797F0F186083711F66C60FA610239B8C46AD30B19FCA43C5FA181A
                                                                                                                                                                                                                  SHA-512:D9848EE6A52CF8DE250CFE0BEAE8FD4583A9D69BAEE8C5A9F5E284FAD595452C29A9B59B4F5D90E81212BA9D32F4C8A8E5EDF897CE420D3F0618C2E854A6F1B7
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:7z..'...)m.A.".....%..........,....]...6.....#.0@.1.zL..[...4b ...A....Z7.~...........}.......m.7!*Q..X,s..T...>~(|.s..%...1`.Yw......vK.Tz.|pu.96...D.......w,2PO;I..Z.{..I..y.pn...P..*G.a...Z...(....R..R8|.\....L...k..}..s&.'.....0.."o.s.ZI.=.(.C.?.Gg...|..^....;.e[.w....<.n.@..&Z...$`p ..OzD...V..r.l...ibH..hv."6.m.5.T{*4nh.....Sx.G..1.'.....8.."..................Zk!`.fd..qN.....{.......O.$.|r.{.a|^.]..K*n..t..e.......o.s.v}.....2[M..1..yG..]Y. ...Z=....?.\#*..)...!k...X....G.%>......t..7.}.G.~HV..D.[.....4....!.....=.r.../P.5*..j1^.!..W).!...J.!H0....Rj..[..0.y.u...5..bC...\..{...Cv...`xN|....2m.A.{..m..y).*B.q.D.y...j.\.R#.CX\n..L>.NN.]..cj{>..p.j}.&..Z<.`7....o.......k..z.. ...?..~g.|m....kysn.q.., b>'.:,p...... .......V..x........0j.......F..3....W.......xO.....w.q..a....s.4#.GWP.........r'...K....+_^"0T=.+.....u)......xEP.Il.}.P>.@{.9{.......*...Q..E..[..[34..wx....Z...$..U.....vg....k.......Z.$j....#.b.rF....#5...XO.u...saZ...'.

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\nsExec.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):6656
                                                                                                                                                                                                                  Entropy (8bit):5.155286976455086
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
                                                                                                                                                                                                                  MD5:EC0504E6B8A11D5AAD43B296BEEB84B2
                                                                                                                                                                                                                  SHA1:91B5CE085130C8C7194D66B2439EC9E1C206497C
                                                                                                                                                                                                                  SHA-256:5D9CEB1CE5F35AEA5F9E5A0C0EDEEEC04DFEFE0C77890C80C70E98209B58B962
                                                                                                                                                                                                                  SHA-512:3F918F1B47E8A919CBE51EB17DC30ACC8CFC18E743A1BAE5B787D0DB7D26038DC1210BE98BF5BA3BE8D6ED896DBBD7AC3D13E66454A98B2A38C7E69DAD30BB57
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....~.\...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nse8E29.tmp\nsis7z.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):434176
                                                                                                                                                                                                                  Entropy (8bit):6.584811966667578
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
                                                                                                                                                                                                                  MD5:80E44CE4895304C6A3A831310FBF8CD0
                                                                                                                                                                                                                  SHA1:36BD49AE21C460BE5753A904B4501F1ABCA53508
                                                                                                                                                                                                                  SHA-256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
                                                                                                                                                                                                                  SHA-512:C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Nov 15 06:28:00 2024, mtime=Fri Nov 15 06:28:08 2024, atime=Thu Nov 14 09:15:50 2024, length=188703744, window=hide
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1152
                                                                                                                                                                                                                  Entropy (8bit):4.914844192005075
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24:88PjHWMUwoRg7/xhK1AEZfdG1373VyoqyFm:8q77U3Rg7FEBdG13qyF
                                                                                                                                                                                                                  MD5:B61BE04E5A3CEB5451265417E87FF2B1
                                                                                                                                                                                                                  SHA1:F948C2C91679DA4A6A7FB4FA44CF7DBC0CE48577
                                                                                                                                                                                                                  SHA-256:1CB5B9D53EF516980CBDF8B45171871D600832F4692BACD2B95465CFBBB504E6
                                                                                                                                                                                                                  SHA-512:E9DDF3CB8CB0ECCD43152FC3C606607677489AE5FF1335D925D39A67D6F67DFC9B9C27153DC04D8AB34D1601E32E68E04D3387BE10AC22F4313CF24802B59161
                                                                                                                                                                                                                  Malicious:true
                                                                                                                                                                                                                  Preview:L..................F.... .....]./7...A+./7.....-~6...d?.......................:..DG..Yr?.D..U..k0.&...&......vk.v.....(../7....../7......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^oYq;...........................%..A.p.p.D.a.t.a...B.P.1.....oY.;..Local.<......CW.^oY.;....b........................L.o.c.a.l.....Z.1.....oYu;..Programs..B......oYs;oYu;..............................P.r.o.g.r.a.m.s.....N.1.....oY.;..Slax..:......oYu;oY.;..........................CK..S.l.a.x.....Z.2..d?.nY.Q .Slax.exe..B......oY.;oY.;..............................S.l.a.x...e.x.e.......b...............-.......a...................C:\Users\user\AppData\Local\Programs\Slax\Slax.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.S.l.a.x.\.S.l.a.x...e.x.e.............:...........|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ...T..b...,.......hT..CrF.f4... ...T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2

                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Slax\81123015-a46f-49c0-9dab-2f51ec1a6bb4.tmp

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                  Category:modified
                                                                                                                                                                                                                  Size (bytes):434
                                                                                                                                                                                                                  Entropy (8bit):5.619419323767266
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6:YKWCRGBmEuZpn9RdrtybHaKc4AirlWTTNsCbsiFL1ZX3/ZHGEXokGhPkzOZU2:YKWSCuj9rrt+hpAikTZL1dxdXRV2
                                                                                                                                                                                                                  MD5:4DCEF41230EA7DFF6280B6C0986A4418
                                                                                                                                                                                                                  SHA1:E239666B78EAC059C2ECEB5FD6162868320E1303
                                                                                                                                                                                                                  SHA-256:FA8BB6B5FCA1E01878867DC43E3FA1E1C4C9288C7D96BF308D8360B5D027BC8D
                                                                                                                                                                                                                  SHA-512:A3F8D6580B4C9617C00DD5138BB578D59B30E7DF6019153EC2052C2107C062DB8F58689F837AA9CE9109AA389715959B6D5281B602C723E9B0C8B7CC98E9DA56
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAqfpC/yur0Qql4XIYAy12ZEAAAABIAAABDAGgAcgBvAG0AaQB1AG0AAAAQZgAAAAEAACAAAACej6J4bv2STjNDCAHivjZ8ks1iYzGF5rZnHdZUuENcgAAAAAAOgAAAAAIAACAAAAD0PtnR/AKzr/JS13NdqYOEiXvVaazPazvs7E8B35RbUTAAAADeLYvyTERTAqXCYHBl/cJpMf896JCxcJZ7kHkqVbwHpwH4edQVAnpN0CgpvSPHV6VAAAAAog6QwJf6zOnvKuZ6IKGy7tVDtaVvjGHFXfvz3Eie8/usEWMRmnuv0TZmqZhURuH0AfTcyTdw0VyWoXKak19vPQ=="}}

                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Slax\Local State (copy)

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):434
                                                                                                                                                                                                                  Entropy (8bit):5.619419323767266
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6:YKWCRGBmEuZpn9RdrtybHaKc4AirlWTTNsCbsiFL1ZX3/ZHGEXokGhPkzOZU2:YKWSCuj9rrt+hpAikTZL1dxdXRV2
                                                                                                                                                                                                                  MD5:4DCEF41230EA7DFF6280B6C0986A4418
                                                                                                                                                                                                                  SHA1:E239666B78EAC059C2ECEB5FD6162868320E1303
                                                                                                                                                                                                                  SHA-256:FA8BB6B5FCA1E01878867DC43E3FA1E1C4C9288C7D96BF308D8360B5D027BC8D
                                                                                                                                                                                                                  SHA-512:A3F8D6580B4C9617C00DD5138BB578D59B30E7DF6019153EC2052C2107C062DB8F58689F837AA9CE9109AA389715959B6D5281B602C723E9B0C8B7CC98E9DA56
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAqfpC/yur0Qql4XIYAy12ZEAAAABIAAABDAGgAcgBvAG0AaQB1AG0AAAAQZgAAAAEAACAAAACej6J4bv2STjNDCAHivjZ8ks1iYzGF5rZnHdZUuENcgAAAAAAOgAAAAAIAACAAAAD0PtnR/AKzr/JS13NdqYOEiXvVaazPazvs7E8B35RbUTAAAADeLYvyTERTAqXCYHBl/cJpMf896JCxcJZ7kHkqVbwHpwH4edQVAnpN0CgpvSPHV6VAAAAAog6QwJf6zOnvKuZ6IKGy7tVDtaVvjGHFXfvz3Eie8/usEWMRmnuv0TZmqZhURuH0AfTcyTdw0VyWoXKak19vPQ=="}}

                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Slax\config.json

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):73
                                                                                                                                                                                                                  Entropy (8bit):4.6397079082489
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:NBH151sHrF+LgpalETbJHK8BHEKY:L151mrFGgaE48BHEKY
                                                                                                                                                                                                                  MD5:6DD3706DC497F1DE99D10C431AA2F9A3
                                                                                                                                                                                                                  SHA1:F086F89BB453CC5A36D480566EFC466F41E9A8A3
                                                                                                                                                                                                                  SHA-256:596D1E305587D3A916911C86EC67174A8424B8293D75D1F7866D612AB76DF2FC
                                                                                                                                                                                                                  SHA-512:2561797527F451589233D61D57A3E81462F5A8F649EC09783941619CCEA16353CF8F95B517AB38C8D966D95B36174626825EBF2FE113D1BF17625719DF278984
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:{. "uuid": "892a3124-4b4a-456d-a217-80fa374fa626",. "installed": true.}

                                                                                                                                                                                                                  \Device\Null

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (427)
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):894
                                                                                                                                                                                                                  Entropy (8bit):4.9273408088918105
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12:xUCUUC7QgfIoEJdWdV+rfIoEJxSqzDtRCYdLUjN00L/WUu5QAmH+NcczIXoeZC+F:iUKQgfBz+rfQD7CyFE/xmQoNcckXoex
                                                                                                                                                                                                                  MD5:245C7039C78025C0F783726B9593E974
                                                                                                                                                                                                                  SHA1:51133E309F7459CC7265212E4FA31403054A1B82
                                                                                                                                                                                                                  SHA-256:C4A5F11C628FB013EFE5F1D98DEA3036600ABE6AE7B749191E42D6444B15FE40
                                                                                                                                                                                                                  SHA-512:0B05F73482CC97986BB49DAA1C8C60833D825FA6541A3E1CE8EB64C32CEA3B6875402011F8D8F792B5BD0867B6EE153070D465BD8D5FDD020FE75C63BAFBEE07
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:(node:6884) UnhandledPromiseRejectionWarning: TypeError: Cannot read properties of undefined (reading 'model'). at getSystemInfo (C:\Users\user\AppData\Local\Programs\Slax\resources\app.asar\main.js:50:31). at App.<anonymous> (C:\Users\user\AppData\Local\Programs\Slax\resources\app.asar\main.js:329:24). at process.processTicksAndRejections (node:internal/process/task_queues:95:5).(Use `Slax --trace-warnings ...` to show where the warning was created).(node:6884) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag `--unhandled-rejections=strict` (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 1).

                                                                                                                                                                                                                  Static File Info

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                  Entropy (8bit):7.999988336585389
                                                                                                                                                                                                                  TrID:
                                                                                                                                                                                                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                  • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                  File name:G4fDWS1Fpd.exe
                                                                                                                                                                                                                  File size:86'638'456 bytes
                                                                                                                                                                                                                  MD5:2e0143d084a2217b24f58d597169cb16
                                                                                                                                                                                                                  SHA1:599870ccdec203f715cdd37ebf402df36400c1e4
                                                                                                                                                                                                                  SHA256:fac7f1a54eef98830ecbd25fef364695b8afd9e255dcc19702dac84ee526c5ca
                                                                                                                                                                                                                  SHA512:8033642d91aa3def6782e028d4e797ef2e260e5f85064b8d8f32b8e3138bdecb27bd3275fd3ca2166d1a41721a2311dee098064bd832ea0ef73cf59fc5d7cbc4
                                                                                                                                                                                                                  SSDEEP:1572864:IA2/ebAbWkGYFLlAfoabh+XJhXhQiB1dJdYVkq7U9GOWwMMArXPWEWy/t:IK0bEYhlAQOh01VJY+qw9dxQXPzl/t
                                                                                                                                                                                                                  TLSH:F418332C0944C2B3C21854BDF7E7C7E74551B7138A0D2FAE223AB17CD35B2E725A95A2
                                                                                                                                                                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

                                                                                                                                                                                                                  File Icon

                                                                                                                                                                                                                  Icon Hash:b846616869b8cc70

                                                                                                                                                                                                                  Static PE Info

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Entrypoint:0x40338f
                                                                                                                                                                                                                  Entrypoint Section:.text
                                                                                                                                                                                                                  Digitally signed:true
                                                                                                                                                                                                                  Imagebase:0x400000
                                                                                                                                                                                                                  Subsystem:windows gui
                                                                                                                                                                                                                  Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                                                                  DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                  Time Stamp:0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
                                                                                                                                                                                                                  TLS Callbacks:
                                                                                                                                                                                                                  CLR (.Net) Version:
                                                                                                                                                                                                                  OS Version Major:4
                                                                                                                                                                                                                  OS Version Minor:0
                                                                                                                                                                                                                  File Version Major:4
                                                                                                                                                                                                                  File Version Minor:0
                                                                                                                                                                                                                  Subsystem Version Major:4
                                                                                                                                                                                                                  Subsystem Version Minor:0
                                                                                                                                                                                                                  Import Hash:b34f154ec913d2d2c435cbd644e91687

                                                                                                                                                                                                                  Authenticode Signature

                                                                                                                                                                                                                  Signature Valid:false
                                                                                                                                                                                                                  Signature Issuer:CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
                                                                                                                                                                                                                  Signature Validation Error:A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file
                                                                                                                                                                                                                  Error Number:-2146762495
                                                                                                                                                                                                                  Not Before, Not After
                                                                                                                                                                                                                  • 15/10/2024 19:29:09 16/10/2025 19:29:09
                                                                                                                                                                                                                  Subject Chain
                                                                                                                                                                                                                  • CN="Lion Software, LLC", O="Lion Software, LLC", STREET=60 County Road 537, L=Centre, S=Alabama, C=US, OID.1.3.6.1.4.1.311.60.2.1.2=Alabama, OID.1.3.6.1.4.1.311.60.2.1.3=US, SERIALNUMBER=000-541-240, OID.2.5.4.15=Private Organization
                                                                                                                                                                                                                  Version:3
                                                                                                                                                                                                                  Thumbprint MD5:AC575FB5F87D72747656ED9FFBAEB0DA
                                                                                                                                                                                                                  Thumbprint SHA-1:A243692CD9205CFE32BEEF144B7D84350F3AA0E6
                                                                                                                                                                                                                  Thumbprint SHA-256:482DFF658DB3FF3B08ED60A99B5434DE6E8CF3F1DCB782831AA0B22978F7C49D
                                                                                                                                                                                                                  Serial:1AF0A44396DD57AC87ECB79D

                                                                                                                                                                                                                  Entrypoint Preview

                                                                                                                                                                                                                  Instruction
                                                                                                                                                                                                                  sub esp, 000002D4h
                                                                                                                                                                                                                  push ebx
                                                                                                                                                                                                                  push esi
                                                                                                                                                                                                                  push edi
                                                                                                                                                                                                                  push 00000020h
                                                                                                                                                                                                                  pop edi
                                                                                                                                                                                                                  xor ebx, ebx
                                                                                                                                                                                                                  push 00008001h
                                                                                                                                                                                                                  mov dword ptr [esp+14h], ebx
                                                                                                                                                                                                                  mov dword ptr [esp+10h], 0040A2E0h
                                                                                                                                                                                                                  mov dword ptr [esp+1Ch], ebx
                                                                                                                                                                                                                  call dword ptr [004080A8h]
                                                                                                                                                                                                                  call dword ptr [004080A4h]
                                                                                                                                                                                                                  and eax, BFFFFFFFh
                                                                                                                                                                                                                  cmp ax, 00000006h
                                                                                                                                                                                                                  mov dword ptr [0047AEECh], eax
                                                                                                                                                                                                                  je 00007F42A8BF3E73h
                                                                                                                                                                                                                  push ebx
                                                                                                                                                                                                                  call 00007F42A8BF7125h
                                                                                                                                                                                                                  cmp eax, ebx
                                                                                                                                                                                                                  je 00007F42A8BF3E69h
                                                                                                                                                                                                                  push 00000C00h
                                                                                                                                                                                                                  call eax
                                                                                                                                                                                                                  mov esi, 004082B0h
                                                                                                                                                                                                                  push esi
                                                                                                                                                                                                                  call 00007F42A8BF709Fh
                                                                                                                                                                                                                  push esi
                                                                                                                                                                                                                  call dword ptr [00408150h]
                                                                                                                                                                                                                  lea esi, dword ptr [esi+eax+01h]
                                                                                                                                                                                                                  cmp byte ptr [esi], 00000000h
                                                                                                                                                                                                                  jne 00007F42A8BF3E4Ch
                                                                                                                                                                                                                  push 0000000Ah
                                                                                                                                                                                                                  call 00007F42A8BF70F8h
                                                                                                                                                                                                                  push 00000008h
                                                                                                                                                                                                                  call 00007F42A8BF70F1h
                                                                                                                                                                                                                  push 00000006h
                                                                                                                                                                                                                  mov dword ptr [0047AEE4h], eax
                                                                                                                                                                                                                  call 00007F42A8BF70E5h
                                                                                                                                                                                                                  cmp eax, ebx
                                                                                                                                                                                                                  je 00007F42A8BF3E71h
                                                                                                                                                                                                                  push 0000001Eh
                                                                                                                                                                                                                  call eax
                                                                                                                                                                                                                  test eax, eax
                                                                                                                                                                                                                  je 00007F42A8BF3E69h
                                                                                                                                                                                                                  or byte ptr [0047AEEFh], 00000040h
                                                                                                                                                                                                                  push ebp
                                                                                                                                                                                                                  call dword ptr [00408044h]
                                                                                                                                                                                                                  push ebx
                                                                                                                                                                                                                  call dword ptr [004082A0h]
                                                                                                                                                                                                                  mov dword ptr [0047AFB8h], eax
                                                                                                                                                                                                                  push ebx
                                                                                                                                                                                                                  lea eax, dword ptr [esp+34h]
                                                                                                                                                                                                                  push 000002B4h
                                                                                                                                                                                                                  push eax
                                                                                                                                                                                                                  push ebx
                                                                                                                                                                                                                  push 00440208h
                                                                                                                                                                                                                  call dword ptr [00408188h]
                                                                                                                                                                                                                  push 0040A2C8h

                                                                                                                                                                                                                  Rich Headers

                                                                                                                                                                                                                  Programming Language:
                                                                                                                                                                                                                  • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                                                                                                  Data Directories

                                                                                                                                                                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x19f0000x7288.rsrc
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x529ed500x1228
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                  Sections

                                                                                                                                                                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                  .text0x10000x66270x68007618d4c0cd8bb67ea9595b4266b3a91fFalse0.6646259014423077data6.450282348506287IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                  .rdata0x80000x14a20x1600eecac1fed9cc6b447d50940d178404d8False0.4405184659090909data5.025178929113415IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                  .data0xa0000x70ff80x600db8f31a08a2242d80c29e1f9500c6527False0.5182291666666666data4.037117731448378IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                  .ndata0x7b0000x1240000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                  .rsrc0x19f0000x72880x7400f69ada40a97c7fc099a1460d31656fb9False0.7685546875data7.154628246749218IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                  Resources

                                                                                                                                                                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                  RT_ICON0x19f4a80x50d5PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States1.0007732083313197
                                                                                                                                                                                                                  RT_DIALOG0x1a45800x202dataEnglishUnited States0.4085603112840467
                                                                                                                                                                                                                  RT_DIALOG0x1a47880xf8dataEnglishUnited States0.6290322580645161
                                                                                                                                                                                                                  RT_DIALOG0x1a48800xeedataEnglishUnited States0.6260504201680672
                                                                                                                                                                                                                  RT_DIALOG0x1a49700x1fadataEnglishUnited States0.40118577075098816
                                                                                                                                                                                                                  RT_DIALOG0x1a4b700xf0dataEnglishUnited States0.6666666666666666
                                                                                                                                                                                                                  RT_DIALOG0x1a4c600xe6dataEnglishUnited States0.6565217391304348
                                                                                                                                                                                                                  RT_DIALOG0x1a4d480x1eedataEnglishUnited States0.38866396761133604
                                                                                                                                                                                                                  RT_DIALOG0x1a4f380xe4dataEnglishUnited States0.6447368421052632
                                                                                                                                                                                                                  RT_DIALOG0x1a50200xdadataEnglishUnited States0.6422018348623854
                                                                                                                                                                                                                  RT_DIALOG0x1a51000x1eedataEnglishUnited States0.3866396761133603
                                                                                                                                                                                                                  RT_DIALOG0x1a52f00xe4dataEnglishUnited States0.6359649122807017
                                                                                                                                                                                                                  RT_DIALOG0x1a53d80xdadataEnglishUnited States0.6376146788990825
                                                                                                                                                                                                                  RT_DIALOG0x1a54b80x1f2dataEnglishUnited States0.39759036144578314
                                                                                                                                                                                                                  RT_DIALOG0x1a56b00xe8dataEnglishUnited States0.6508620689655172
                                                                                                                                                                                                                  RT_DIALOG0x1a57980xdedataEnglishUnited States0.6486486486486487
                                                                                                                                                                                                                  RT_DIALOG0x1a58780x202dataEnglishUnited States0.42217898832684825
                                                                                                                                                                                                                  RT_DIALOG0x1a5a800xf8dataEnglishUnited States0.6653225806451613
                                                                                                                                                                                                                  RT_DIALOG0x1a5b780xeedataEnglishUnited States0.6512605042016807
                                                                                                                                                                                                                  RT_GROUP_ICON0x1a5c680x14dataEnglishUnited States1.05
                                                                                                                                                                                                                  RT_VERSION0x1a5c800x1e0dataEnglishUnited States0.51875
                                                                                                                                                                                                                  RT_MANIFEST0x1a5e600x423XML 1.0 document, ASCII text, with very long lines (1059), with no line terminatorsEnglishUnited States0.5127478753541076

                                                                                                                                                                                                                  Imports

                                                                                                                                                                                                                  DLLImport
                                                                                                                                                                                                                  KERNEL32.dllSetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
                                                                                                                                                                                                                  USER32.dllGetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
                                                                                                                                                                                                                  GDI32.dllSelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                                                                                                                                                                                  SHELL32.dllSHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
                                                                                                                                                                                                                  ADVAPI32.dllAdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
                                                                                                                                                                                                                  COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                                                                                                                                                                                  ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                                                                                                                                                                                  Possible Origin

                                                                                                                                                                                                                  Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                  EnglishUnited States

                                                                                                                                                                                                                  Network Behavior

                                                                                                                                                                                                                  ⊘No network behavior found

                                                                                                                                                                                                                  Statistics

                                                                                                                                                                                                                  CPU Usage

                                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                                  Memory Usage

                                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                                  High Level Behavior Distribution

                                                                                                                                                                                                                  Click to dive into process behavior distribution

                                                                                                                                                                                                                  Behavior

                                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                                  System Behavior

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:0
                                                                                                                                                                                                                  Start time:02:27:36
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\Desktop\G4fDWS1Fpd.exe
                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                  Commandline:"C:\Users\user\Desktop\G4fDWS1Fpd.exe"
                                                                                                                                                                                                                  Imagebase:0x400000
                                                                                                                                                                                                                  File size:86'638'456 bytes
                                                                                                                                                                                                                  MD5 hash:2E0143D084A2217B24F58D597169CB16
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:1
                                                                                                                                                                                                                  Start time:02:27:39
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                  Commandline:"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Slax.exe" /FO csv | "C:\Windows\system32\find.exe" "Slax.exe"
                                                                                                                                                                                                                  Imagebase:0x240000
                                                                                                                                                                                                                  File size:236'544 bytes
                                                                                                                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:2
                                                                                                                                                                                                                  Start time:02:27:39
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                  Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:3
                                                                                                                                                                                                                  Start time:02:27:39
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                  Commandline:tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Slax.exe" /FO csv
                                                                                                                                                                                                                  Imagebase:0xa90000
                                                                                                                                                                                                                  File size:79'360 bytes
                                                                                                                                                                                                                  MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:4
                                                                                                                                                                                                                  Start time:02:27:39
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\find.exe
                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                  Commandline:"C:\Windows\system32\find.exe" "Slax.exe"
                                                                                                                                                                                                                  Imagebase:0xb00000
                                                                                                                                                                                                                  File size:14'848 bytes
                                                                                                                                                                                                                  MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:moderate
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:8
                                                                                                                                                                                                                  Start time:02:28:06
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Programs\Slax\Slax.exe"
                                                                                                                                                                                                                  Imagebase:0x7ff6eef20000
                                                                                                                                                                                                                  File size:188'703'744 bytes
                                                                                                                                                                                                                  MD5 hash:262797985453830673179336B6BACAC6
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Antivirus matches:
                                                                                                                                                                                                                  • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:11
                                                                                                                                                                                                                  Start time:02:28:09
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1760,i,7052398392554665292,13112330197020623340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2
                                                                                                                                                                                                                  Imagebase:0x7ff732630000
                                                                                                                                                                                                                  File size:188'703'744 bytes
                                                                                                                                                                                                                  MD5 hash:262797985453830673179336B6BACAC6
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:12
                                                                                                                                                                                                                  Start time:02:28:08
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()""
                                                                                                                                                                                                                  Imagebase:0x7ff691ed0000
                                                                                                                                                                                                                  File size:289'792 bytes
                                                                                                                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:13
                                                                                                                                                                                                                  Start time:02:28:08
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                  Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:14
                                                                                                                                                                                                                  Start time:02:28:08
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"
                                                                                                                                                                                                                  Imagebase:0x7ff788560000
                                                                                                                                                                                                                  File size:452'608 bytes
                                                                                                                                                                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:15
                                                                                                                                                                                                                  Start time:02:28:12
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2528,i,7052398392554665292,13112330197020623340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
                                                                                                                                                                                                                  Imagebase:0x7ff732630000
                                                                                                                                                                                                                  File size:188'703'744 bytes
                                                                                                                                                                                                                  MD5 hash:262797985453830673179336B6BACAC6
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:16
                                                                                                                                                                                                                  Start time:02:28:22
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Programs\Slax\Slax.exe"
                                                                                                                                                                                                                  Imagebase:0x7ff732630000
                                                                                                                                                                                                                  File size:188'703'744 bytes
                                                                                                                                                                                                                  MD5 hash:262797985453830673179336B6BACAC6
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:17
                                                                                                                                                                                                                  Start time:02:28:24
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1740,i,15859010876315112086,12757602484505537374,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2
                                                                                                                                                                                                                  Imagebase:0x7ff732630000
                                                                                                                                                                                                                  File size:188'703'744 bytes
                                                                                                                                                                                                                  MD5 hash:262797985453830673179336B6BACAC6
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:18
                                                                                                                                                                                                                  Start time:02:28:22
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()""
                                                                                                                                                                                                                  Imagebase:0x7ff691ed0000
                                                                                                                                                                                                                  File size:289'792 bytes
                                                                                                                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:19
                                                                                                                                                                                                                  Start time:02:28:22
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                  Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:20
                                                                                                                                                                                                                  Start time:02:28:22
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Slax\Slax.exe';$s.Save()"
                                                                                                                                                                                                                  Imagebase:0x7ff788560000
                                                                                                                                                                                                                  File size:452'608 bytes
                                                                                                                                                                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:21
                                                                                                                                                                                                                  Start time:02:28:25
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --field-trial-handle=2400,i,15859010876315112086,12757602484505537374,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3
                                                                                                                                                                                                                  Imagebase:0x7ff732630000
                                                                                                                                                                                                                  File size:188'703'744 bytes
                                                                                                                                                                                                                  MD5 hash:262797985453830673179336B6BACAC6
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:23
                                                                                                                                                                                                                  Start time:02:30:09
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1224,i,7052398392554665292,13112330197020623340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
                                                                                                                                                                                                                  Imagebase:0x7ff732630000
                                                                                                                                                                                                                  File size:188'703'744 bytes
                                                                                                                                                                                                                  MD5 hash:262797985453830673179336B6BACAC6
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:24
                                                                                                                                                                                                                  Start time:02:30:24
                                                                                                                                                                                                                  Start date:15/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Programs\Slax\Slax.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Programs\Slax\Slax.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Slax" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2504,i,15859010876315112086,12757602484505537374,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
                                                                                                                                                                                                                  Imagebase:0x7ff732630000
                                                                                                                                                                                                                  File size:188'703'744 bytes
                                                                                                                                                                                                                  MD5 hash:262797985453830673179336B6BACAC6
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  Disassembly

                                                                                                                                                                                                                  ⊘No disassembly