Windows Analysis Report
nsis-installer.exe

Overview

General Information

Sample name: nsis-installer.exe
Analysis ID: 1427113
MD5: 85aea19a596f59d0dbf368f99be6a139
SHA1: 9fd84c0780b6555cdeed499b30e5d67071998fbc
SHA256: 7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b
Infos:

Detection

Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Loading BitLocker PowerShell Module
Opens the same file many times (likely Sandbox evasion)
Tries to steal communication platform credentials (via file / registry access)
Binary contains a suspicious time stamp
Contains functionality for read data from the clipboard
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains sections with non-standard names
Queries keyboard layouts
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Console CodePage Lookup Via CHCP
Sigma detected: Startup Folder File Write
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: nsis-installer.exe Avira: detected
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\496db3a3-1a7f-4f1b-9fcf-efdaeed463f0.tmp.node Virustotal: Detection: 7% Perma Link
Source: C:\Users\user\AppData\Local\Temp\8643e452-b938-4f7e-b6f6-6c79c3287391.tmp.node Virustotal: Detection: 8% Perma Link
Source: C:\Users\user\AppData\Local\Temp\a5cccf86-07fd-48a4-a9cf-7cd44af85556.tmp.node Virustotal: Detection: 7% Perma Link
Source: C:\Users\user\AppData\Local\Temp\e10a37c2-8429-4258-9cd3-d725395e8215.tmp.node Virustotal: Detection: 8% Perma Link
Multi AV Scanner detection for submitted file
Source: nsis-installer.exe ReversingLabs: Detection: 37%
Source: nsis-installer.exe Virustotal: Detection: 30% Perma Link
Uses 32bit PE files
Source: nsis-installer.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\nsis-installer.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cfbc383d-9aa0-5771-9485-7b806e8442d5 Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\7z-out\LICENSE.electron.txt Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\LICENSE.electron.txt Jump to behavior
Source: nsis-installer.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: BCC = $(NCC) -nologo -W3 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: nsis-installer.exe, 00000000.00000003.2342229721.0000000002DCA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: del /Q *.exp *.lo *.ilk *.lib *.obj *.ncb *.pdb *.sdf *.suo 2>NUL source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: LTCOMPILE = $(TCC) -Fo$@ -Fd$*.pdb source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: CLEANFILES="$CLEANFILES *.lib *.dll *.pdb *.exp" source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\STATEMENT.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\SRC\STATEMENT.CC source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /OUT:"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.NODE" /INCREMENTAL:NO /NOLOGO KERNEL32.LIB USER32.LIB GDI32.LIB WINSPOOL.LIB COMDLG32.LIB ADVAPI32.LIB SHELL32.LIB OLE32.LIB OLEAUT32.LIB UUID.LIB ODBC32.LIB DELAYIMP.LIB "C:\\USERS\\ADMINISTRATOR\\.ELECTRON-GYP\\24.1.1\\IA32\\NODE.LIB" DELAYIMP.LIB /DELAYLOAD:NODE.EXE /MANIFEST /MANIFESTUAC:"level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG /PDB:"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB" /OPT:REF /OPT:ICF /TLBID:1 /DYNAMICBASE /NXCOMPAT /MACHINE:X86 /SAFESEH /LTCG:INCREMENTAL /ignore:4199 /DLL RELEASE\OBJ\NODE_SQLITE3\WIN_DELAY_LOAD_HOOK.OBJ source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\COMMUNITY\VC\TOOLS\MSVC\14.39.33519\LIB\X86\LIBCMT.I386.PDB source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: nsis-installer.exe, 00000000.00000003.2208092330.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2265396042.00000000050CB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM ) ;; source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: -typedil-fC:\Users\Administrator\Desktop\duvet\src\builds\iL3GxpTZu\source\node_modules\node-gyp\src\win_delay_load_hook.cc-Gs4096-dos-Zi-Z7-W3-pdbrpc-Og-Ob2-Ot-EHs-MT-GS-Gy-FitObjFunc-FitObjData-NoRTTI-FoC:\Users\Administrator\Desktop\duvet\src\builds\iL3GxpTZu\source\node_modules\sqlite3\build\deps\Release\obj\sqlite3\win_delay_load_hook.obj-FdC:\Users\Administrator\Desktop\duvet\src\builds\iL3GxpTZu\source\node_modules\sqlite3\build\Release\sqlite3.pdb-errorreport:queue source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\NODE_SQLITE3.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\SRC\NODE_SQLITE3.CC source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\COMMUNITY\VC\TOOLS\MSVC\14.39.33519\LIB\X86\LIBCPMT.I386.PDB source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2269640861.00000000050C2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: -FdC:\Users\Administrator\Desktop\duvet\src\builds\iL3GxpTZu\source\node_modules\sqlite3\build\Release\sqlite3.pdb source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb`)p) source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2269640861.00000000050C2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\NODE-GYP\SRC\WIN_DELAY_LOAD_HOOK.CC source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: SQLITE3EXEPDB = /pdb:sqlite3sh.pdb source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\COMMUNITY\VC\TOOLS\MSVC\14.39.33519\LIB\X86\LIBVCRUNTIME.I386.PDB source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** rbu_file.pDb!=0, then it is assumed to already be present on the source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libEGL.dll.pdb source: nsis-installer.exe, 00000000.00000003.2208092330.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: BCC = $(NCC) -nologo -W4 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: nsis-installer.exe, 00000000.00000003.2336434743.00000000050C2000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2260611134.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\BACKUP.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\SRC\BACKUP.CC source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\Administrator\Desktop\duvet\src\builds\iL3GxpTZu\source\node_modules\sqlite3\build\Release\sqlite3.pdb source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** for all file descriptors with rbu_file.pDb!=0. If the argument has source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libEGL.dll.pdb source: nsis-installer.exe, 00000000.00000003.2208092330.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** rbu_file.pDb!=0. source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\DATABASE.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\SRC\DATABASE.CC source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: nsis-installer.exe, 00000000.00000003.2256512300.0000000004B80000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2338261653.0000000004E41000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2260611134.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2256207119.0000000002E60000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\nsis-installer.exe Code function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_004059CC
Source: C:\Users\user\Desktop\nsis-installer.exe Code function: 0_2_004065FD FindFirstFileW,FindClose, 0_2_004065FD
Source: C:\Users\user\Desktop\nsis-installer.exe Code function: 0_2_00402868 FindFirstFileW, 0_2_00402868
Source: C:\Users\user\Desktop\nsis-installer.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe File opened: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe File opened: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe File opened: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Jump to behavior
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View IP Address: 172.64.41.3 172.64.41.3
May check the online IP address of the machine
Source: unknown DNS query: name: ipinfo.io
Source: unknown DNS query: name: ipinfo.io
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: V8.MemoryHeapUsedV8.MemoryHeapCommittedmail.google.com.gmaildrive.google.com.docsplus.google.com.plus.inbox.calendarwww.youtube.com.youtube.top10sina.com.cnfacebook.combaidu.comtwitter.comtaobao.comwikipedia equals www.youtube.com (Youtube)
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: ipinfo.io
Source: unknown HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.css
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.jpg
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1085
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1452
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1452expandIntegerPowExpressionsThe
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1512
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1637
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1936
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2046
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2152
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2152skipVSConstantRegisterZeroIn
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2273
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2894
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2978
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3027
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3045
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3246
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3246allowClearForRobustResourceInitSome
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3682
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3682allowES3OnFL100Allow
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3729
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3997
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4214
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4267
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4646
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/482
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007disableDrawBuffersIndexedDisable
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5469
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5577
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658forceGlErrorCheckingForce
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750forceRobustResourceInitForce-enable
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041forceInitShaderVariablesForce-enable
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036dumpShaderSourceWrite
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279cacheCompiledShaderEnable
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7527
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724disableAnisotropicFilteringDisable
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760enableShaderSubstitutionCheck
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761Frontend
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://blog.izs.me)
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://blog.izs.me/)
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://certificates.godaddy.com/repository/gd_intermediate.crt0
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://certificates.godaddy.com/repository100.
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cgit.freedesktop.org/xorg/xserver/tree/COPYING
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cldr.unicode.org/index/downloads
Source: nsis-installer.exe, 00000000.00000003.2261777652.0000000007290000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://code.google.com/p/closure-compiler/wiki/SourceMaps
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.google.com/p/smhasher/
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.google.com/p/v8
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1094869
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/110263
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1144207
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1165751
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1165751disableProgramBinaryDisable
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1171371
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1181068
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1181193
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/308366
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/403957
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/550292
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/565179
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/642227
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/642605
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/644669
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/650547
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/672380
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/709351
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/797243
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/809422
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/830046
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/849576
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/883276
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/927470
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/941620
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere
Source: nsis-installer.exe, 00000000.00000003.2261777652.0000000007290000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: nsis-installer.exe, 00000000.00000003.2261777652.0000000007290000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: nsis-installer.exe, 00000000.00000003.2261777652.0000000007290000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.godaddy.com/gds1-20
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://devel.freebsoft.org/speechd
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://developer.android.com/tools/extras/support-library.html
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/common
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/commonnode-set..
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://fedorahosted.org/lohit>
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://fossil-scm.org).
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://freedesktop.org
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://git.linuxtv.org/v4l-utils.git
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.github.io/snappy/
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://html4/loose.dtd
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://icl.com/saxon
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://icl.com/saxonorg.apache.xalan.xslt.extensions.RedirectxsltDocumentElem:
Source: nsis-installer.exe, 00000000.00000003.2342229721.0000000002DCA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://int3.de/
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://istanbul-js.org/
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://labs.creativecommons.org/licenses/zero-waive/1.0/us/legalcode>
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://localhosthttp://127.0.0.1object-src
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://mxr.mozilla.org/comm-central/source/mozilla/netwerk/base/src/nsURLParsers.cpp
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://n8.io/)
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://narwhaljs.org)
Source: nsis-installer.exe, 00000000.00000002.2380954483.000000000040A000.00000004.00000001.01000000.00000003.sdmp, nsis-installer.exe, 00000000.00000000.2130486279.000000000040A000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.godaddy.com/0J
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://re-becca.org)
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://re-becca.org/)
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://s..
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://scripts.sil.org/OFL
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://source.android.com/
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://source.android.com/compatibility)
Source: nsis-installer.exe, 00000000.00000003.2261777652.0000000007290000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://src.chromium.org/viewvc/chrome/trunk/deps/third_party/xz/COPYING
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tukaani.org/xz/
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://userguide.icu-project.org/strings/properties
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://valgrind.org
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://web.archive.org/
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://webkit.org/
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://wpad/wpad.dat
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://wpad/wpad.dat..
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.chromium.org
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.fossil-scm.org/
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.freedesktop.org/wiki/Software/xdg-user-dirs
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.futurealoof.com)
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.gnu.org/licenses/
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.gutenberg.org/ebooks/53).
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3C//DTD
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.icu-project.org/userguide/posix.html#case_mappings
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.jclark.com/xt
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.linux-usb.org/usb-ids.html
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.midnight-commander.org/browser/lib/tty/key.c
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/MPL/
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.nongnu.org/freebangfont/downloads.html#mukti
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ploscompbiol.org/static/license
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.software-architect.net/blog/article/date/2015/06/12/-826c6e5052.html
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/compile.html).
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/src/info/6709574d2a
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/src/info/f2369304e4
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/tclsqlite.html
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.squid-cache.org/Doc/config/half_closed_clients/
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.strongtalk.org/
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.suitable.com
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.suitable.com/tools/smslib.html
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.suitable.com/tools/smslib.html>
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.unicode.org
Source: nsis-installer.exe, 00000000.00000003.2185816773.0000000005CC0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.unicode.org/copyright.html
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.webrtc.org
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xmlsoft.org/XSLT/
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xmlsoft.org/XSLT/namespace
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xmlsoft.org/XSLT/namespacehttp://www.jclark.com/xtxsl:key
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xmlsoft.org/XSLT/xsltNewExtDef
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://zlib.net/
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4674
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4849
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5140
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5536
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246enableCaptureLimitsSet
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7405
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/upload
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/uploadhttps://beacons.gvt2.com/domainreliability/uplo
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons.gvt2.com/domainreliability/upload
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons2.gvt2.com/domainreliability/upload
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons3.gvt2.com/domainreliability/upload
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons4.gvt2.com/domainreliability/upload
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons5.gvt2.com/domainreliability/upload
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons5.gvt3.com/domainreliability/upload
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bit.ly/3rpDuEX.
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bit.ly/3rpDuEX.WebBundleURLLoaderFactory::OnResponseParsedInvalid
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.htmlMixed
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=10201
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=107106
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=745678
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.android.clients.google.com/
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.bigcache.googleapis.com/
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.doc-0-0-sj.sj.googleusercontent.com/
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.docs.google.com/
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.drive.google.com/
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.googlesyndication.com/
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.pack.google.com/
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.play.google.com/
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.youtube.com/
Source: SerenityTherapyInstaller.exe, 00000008.00000000.2365305161.0000000007205000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://chrome-devtools-frontend.appspot.com/
Source: SerenityTherapyInstaller.exe, 00000008.00000000.2365305161.0000000007205000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebC
Source: nsis-installer.exe, 00000000.00000003.2342167557.0000000004E41000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=ur&category=theme81https://myactivity.google.com/myactivity/?u
Source: nsis-installer.exe, 00000000.00000003.2342167557.0000000004E41000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TW&category=theme81https://myactivity.google.com/myactivity
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://chromestatus.com/feature/5105856067141632.
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://chromestatus.com/feature/5463833265045504.
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://chromestatus.com/feature/5463833265045504.Found
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://chromium.googlesource.com/angle/angle/
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chromium.googlesource.com/vulkan-deps/
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chromium.googlesource.com/webm/libwebm
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chromium.googlesource.com/webm/libwebp
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/domainreliability/upload
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#clear
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#console-namespace
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#count
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#count-map
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#countreset
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#table
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1038223.
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1042393
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1046462
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1060012
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1091824
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1137851
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1154140
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1300575
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1356053
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1412729
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/593024
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/593024selectViewInGeometryShaderThe
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/619103.
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/619103.Subsequence
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/650547
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/650547callClearTwiceUsing
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/655534
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/655534useSystemMemoryForConstantBuffersCopying
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/705865
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/710443
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/811661
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/848952
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/927119
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/927119..
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/981419
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/v8/7848
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://creativecommons.org/licenses/by/3.0/
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://cs.chromium.org/chromium/src/v8/tools/SourceMap.js?rcl=dd10454c1d
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling.
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7231#section-6.4
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7238
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dejavu-fonts.github.io/Download.html
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.chrome.com/blog/enabling-shared-array-buffer/
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.chrome.com/blog/immutable-document-domain/
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.chrome.com/docs/extensions/mv3/cross-origin-isolation/.
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/SpiderMonkey/Parser_API
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/PerformanceResourceTiming
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Equality_comparisons_and_sameness#Loose_equa
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://developers.google.com/android/guides/setup
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developers.google.com/web/updates/2016/08/removing-document-write
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://elinux.org/RPI_vcgencmd_usage
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://elinux.org/RPi_HardwareHistory
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org/#encode-and-enqueue-a-chunk
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org/#encode-and-flush
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org/#textdecoder
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org/#textencoder
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://esdiscuss.org/topic/isconstructor#content-11
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fetch.spec.whatwg.org/
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fetch.spec.whatwg.org/#fetch-timing-info
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gcp.gvt2.com/
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gcp.gvt6.com/
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gist.github.com/XVilka/8346728#gistcomment-2823421
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Buzut)
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Cyan4973/xxHash
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/GoogleChromeLabs/text-fragments-polyfill
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Cross
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers.git
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools.git
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/Vulkan-Headers
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/Vulkan-Loader
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Squirrel/Squirrel.Mac
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/TooTallNate/util-deprecate
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.border-boxcontent-bo
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/WICG/scheduling-apis
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/WICG/shared-element-transitions/blob/main/debugging_overflow_on_images.md.
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/WICG/view-transitions/blob/main/debugging_overflow_on_images.md
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/WebAssembly/esm-integration/issues/42
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/aawc/unrar.git
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/acornjs/acorn/blob/master/acorn/src/identifier.js#L23
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/acornjs/acorn/issues/575
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/addaleax/eventemitter-asyncresource
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/ansi-regex/blob/HEAD/index.js
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/supports-color
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorith
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/csy1983)
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/electron/electron/issues/18397.
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/electron/electron/issues/18397.Module
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/estree/estree/blob/a27003adf4fd7bfad44de9cef372a2eacd527b1c/es5.md#regexpliteral
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/glegrain)
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.js
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/startSES.js
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/closure-compiler/wiki/Source-Maps
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/diff-match-patch/tree/master/javascript
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/distributed_point_functions
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/google-api-cpp-client/
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/ruy
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/ukey2
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/woff2
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/wuffs-mirror-release-c
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/xnnpack
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/heycam/webidl/pull/946.
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/iarna/unique-filename
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/iarna/unique-filename.git
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/iarna/wide-align
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/color-support.
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/minipass.git
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/node-tar.git
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/yallist.git
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/joyent/node
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/joyent/node/issues/3295.
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/lapsio)
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/libuv/libuv/pull/1501.
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/pump
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/tar-fs
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/tar-fs.git
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/tar-stream
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/tar-stream.git
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mikeal/tunnel-agent
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mysticatea/abort-controller
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node-v0.x-archive/issues/2876.
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/commit/ec2822adaad76b126b5cccdeaa1addf2376c9aa6
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/10673
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/13435
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/13581
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/19009
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/2006
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/3392
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/34532
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/35452
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/35475
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/35862
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/35981
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/39707
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/39758
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/45699
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/12342
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/12607
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/13870#discussion_r124515293
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/21313
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/26334.
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/30380#issuecomment-552948364
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/30958
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/32887
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/33515.
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/33661
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/3394
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/34010
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/34103#issuecomment-652002364
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/34375
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/34385
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/35941
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/35949#issuecomment-722496598
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/36061#discussion_r533718029
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/38248
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/38433#issuecomment-828426932
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/38614)
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/43714
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/44952
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/46161
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/string_decoder
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/node-semver.git
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/node-tar/blob/51b6627a1f357d2eb433e7378e5f05e83b7aa6cd/lib/header.js#L349
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/node-tar/issues/183
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/node-tar/pull/187
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/ssri
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/wrappy
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/richy24)
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/sebhildebrandt/systeminformation.git
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/sponsors/sindresorhus
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/standard-things/esm/issues/821.
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tc39/ecma262/blob/HEAD/LICENSE.md
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tc39/ecma262/issues/1209
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tc39/proposal-iterator-helpers/issues/169
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tc39/proposal-ses/blob/e5271cc42a257a05dcae2fd94713ed2f46c08620/shim/src/freeze.j
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tc39/proposal-weakrefs
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/models
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/tensorflow
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/text.git
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/tflite-support
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/ServiceWorker/issues/1356.
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/ServiceWorker/issues/1356.v8.produceCachev8.produceModuleCacheV8.ProduceCodeC
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/gamepad/pull/120
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/gamepad/pull/120Access
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-featuresDeviceOri
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/webappsec-trusted-types/wiki/Trusted-Types-for-function-constructor
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/wasdk/wasmparser
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/web-animations/web-animations-js
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gitlab.freedesktop.org/wayland/weston
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gitlab.freedesktop.org/xdg/xdgmime
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gitlab.freedesktop.org/xorg/proto/xproto/
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/LdLk22
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/LdLk22MEDIA_ELEMENT_ERROR:
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/LdLk22Media
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/rStTGz
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/t5IS6M).
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/xX8pDD
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/xX8pDDplay()
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/ximf56
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/ximf56Iframe
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gle/chrome-insecure-origins
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://google-analytics.com/
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://googlevideo.com/
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gvt1.com/
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gvt2.com/
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gvt6.com/
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#Replaceable
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#define-the-operations
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#dfn-class-string
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#dfn-default-iterator-object
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#dfn-iterator-prototype-object
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-interfaces
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-iterable
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-iterable-entries
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-iterators
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-namespaces
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-operations
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-stringifier
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequentlyOut
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/dom.html#custom-data-attribute.
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#forgiving-base64
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#forgiving-base64-decode
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://invisible-island.net/ncurses/terminfo.ti.html#toc-_Specials
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903emulatePixelLocalStorageEmulate
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: nsis-installer.exe, 00000000.00000003.2261777652.0000000007290000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://jimmy.warting.se/opensource
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://linux.die.net/man/1/dircolors).
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://no-color.org/
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode).
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/fs.html
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/fs.html#fs_stat_time_values)
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/http.html#http_class_http_incomingmessage
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/download/release/v18.14.0/node-v18.14.0-headers.tar.gz
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/download/release/v18.14.0/node-v18.14.0.tar.gz
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/download/release/v18.14.0/node-v18.14.0.tar.gzhttps://nodejs.org/download/release
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/download/release/v18.14.0/win-x86/node.lib
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/en/docs/inspector
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/en/docs/inspectorFor
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/static/images/favicons/favicon.ico
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/static/images/favicons/favicon.icofaviconUrldevtoolsFrontendUrldevtoolsFrontendUr
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pagure.io/lohit
Source: SerenityTherapyInstaller.exe, 00000008.00000000.2365305161.0000000007205000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://perfetto.dev/docs/contributing/getting-started#community).
Source: SerenityTherapyInstaller.exe, 00000008.00000000.2365305161.0000000007205000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://perfetto.dev/docs/contributing/getting-started#community).No
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://plus-innovations.com)
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html).
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://semver.org/
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sindresorhus.com
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sindresorhus.com)
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/site/gaviotachessuser/Home/endgame-tablebases-1
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://source.chromium.org/chromium/chromium/src/
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/wtl/files/WTL%2010/
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sourcemaps.info/spec.html
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/08a0d6d9bf
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/157dc791df
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/206d99a16dd9212f
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/24083b579d.
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/2d76f2bcf65d256a
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/36937b197273d403
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/51e6959f61
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/68d284c86b082c3e
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/726219164b
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/83cb4a95a0
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/b40696f50145d21c
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/eb8613976a
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/src/info/0f0428096f17252a
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/src/info/b043a54c3de54b28
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/src/info/c94369cae9b561b1
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/src/info/ce8717f0885af975
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/src/info/fd76310a5e843e07
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com/
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/a/5501711/3561
Source: nsis-installer.exe, 00000000.00000003.2342167557.0000000004E41000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: nsis-installer.exe, 00000000.00000003.2342167557.0000000004E41000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://swiftshader.googlesource.com/SwiftShader
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://systeminformation.io
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.es/ecma262/#sec-%typedarray%-intrinsic-object
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.es/ecma262/#sec-timeclip
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.es/ecma262/#table-typeof-operator-results
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-%typedarray%.of
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-object.prototype.tostring
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://testanything.org/tap-version-14-specification.html
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://testanything.org/tap-version-14-specification.html#subtests
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2397#section-2
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc3986#section-3.2.2
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc5234#appendix-B.1
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc6455#section-1.3
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.2
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.6
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7540#section-8.1.2.5
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#cannot-have-a-username-password-port
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-url
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-url-origin
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-parser
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-serializer
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#forbidden-host-code-point
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#special-scheme
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#url
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#url-serializing
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams-stringification-behavior
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8.dev/blog/v8-release-89
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/manifest/#installability-signals
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/resource-timing/#dfn-mark-resource-timing
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/resource-timing/#dfn-setup-the-resource-timing-entry
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/resource-timing/#dom-performance-setresourcetimingbuffersize
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#grammardef-option-expression
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#integrity-metadata-description
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#parse-metadata
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#the-integrity-attribute
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://webassembly.github.io/spec/web-api
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://webidl.spec.whatwg.org/#es-dictionary
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wiki.ubuntuusers.de/lsblk/
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.buymeacoffee.com/systeminfo
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/4664843055398912
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5082396709879808
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5093566007214080
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5636954674692096
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5718547946799104
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5738264052891648
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5745543795965952
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5745543795965952unload/beforeunload
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5851021045661696.
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5851021045661696.The
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/6662647093133312
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/6662647093133312InputDeviceCapabilities
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromium.org/blink/origin-trials/portals.
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromium.org/blink/origin-trials/portals.The
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.dmtf.org/sites/default/files/standards/documents/DSP0134_3.4.0a.pdf
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-line-terminators
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-promise.all
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Alternative
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Atom
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClass
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClassEscape
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtom
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtomNoDash
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassRanges
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlEscape
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlLetter
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalDigits
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalEscape
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Disjunction
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Hex4Digits
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigit
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigits
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexEscapeSequence
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRanges
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRangesNoDash
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-OctalDigit
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Pattern
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-PatternCharacter
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Quantifier
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-QuantifierPrefix
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-RegExpUnicodeEscapeSequence
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-SyntaxCharacter
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Assertion
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-AtomEscape
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-CharacterEscape
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassControlLetter
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassEscape
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedAtom
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedPatternCharacter
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-IdentityEscape
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-InvalidBracedQuantifier
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-LegacyOctalEscapeSequence
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Term
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-term
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.iana.org/assignments/tls-extensiontype-values
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.inetdaemon.com/tutorials/internet/ip/routing/default_route.shtml
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.raspberrypi.org/documentation/hardware/raspberrypi/revision-codes/README.md
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.rfc-editor.org/rfc/rfc9110#section-5.2
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.sqlite.org/src/info/083f9e6270).
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.sqlite.org/src/info/908f001483982c43
Source: nsis-installer.exe, 00000000.00000003.2203135466.00000000057C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.sqlite.org/src/info/bba7b69f9849b5bf
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.swift.org/download/
Source: nsis-installer.exe, 00000000.00000003.2261150815.0000000006D50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt
Source: nsis-installer.exe, 00000000.00000003.2276494222.00000000050C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.unicode.org/copyright.html.
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://xhr.spec.whatwg.org/.
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\nsis-installer.exe Code function: 0_2_00405461 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00405461
Installs a raw input device (often for capturing keystrokes)
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: RegisterRawInputDevices() failed for RIDEV_REMOVE memstr_8d7e117d-c
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\nsis-installer.exe Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_0040338F
Detected potential crypto function
Source: C:\Users\user\Desktop\nsis-installer.exe Code function: 0_2_00406B15 0_2_00406B15
Source: C:\Users\user\Desktop\nsis-installer.exe Code function: 0_2_004072EC 0_2_004072EC
Source: C:\Users\user\Desktop\nsis-installer.exe Code function: 0_2_00404C9E 0_2_00404C9E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 19_2_0526B950 19_2_0526B950
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 19_2_05266808 19_2_05266808
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 19_2_0526EE00 19_2_0526EE00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 19_2_0526B94F 19_2_0526B94F
Enables security privileges
Source: C:\Users\user\Desktop\nsis-installer.exe Process token adjusted: Security Jump to behavior
PE / OLE file has an invalid certificate
Source: nsis-installer.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: nsis-installer.exe, 00000000.00000003.2336434743.00000000050C2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevk_swiftshader.dll, vs nsis-installer.exe
Source: nsis-installer.exe, 00000000.00000003.2208092330.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibEGL.dllb! vs nsis-installer.exe
Source: nsis-installer.exe, 00000000.00000003.2208092330.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs nsis-installer.exe
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dllb! vs nsis-installer.exe
Source: nsis-installer.exe, 00000000.00000003.2342229721.0000000002DCA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameElevate.exeH vs nsis-installer.exe
Source: nsis-installer.exe, 00000000.00000003.2269640861.00000000050C2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dllb! vs nsis-installer.exe
Source: nsis-installer.exe, 00000000.00000003.2260611134.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevk_swiftshader.dll, vs nsis-installer.exe
Source: nsis-installer.exe, 00000000.00000003.2264196913.00000000050CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs nsis-installer.exe
Uses 32bit PE files
Source: nsis-installer.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engine Classification label: mal76.spyw.evad.winEXE@76/131@48/3
Source: C:\Users\user\Desktop\nsis-installer.exe Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_0040338F
Source: C:\Users\user\Desktop\nsis-installer.exe Code function: 0_2_00404722 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_00404722
Source: C:\Users\user\Desktop\nsis-installer.exe Code function: 0_2_00402104 CoCreateInstance, 0_2_00402104
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2136:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2356:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3916:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3608:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3212:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6704:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6520:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2496:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5172:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6212:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5700:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1008:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1864:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6140:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3652:120:WilError_03
Source: C:\Users\user\Desktop\nsis-installer.exe Mutant created: \Sessions\1\BaseNamedObjects\cfbc383d-9aa0-5771-9485-7b806e8442d5
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Temp\nscFBA.tmp Jump to behavior
Source: nsis-installer.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SERENITYTHERAPYINSTALLER.EXE'
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\Desktop\nsis-installer.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: nsis-installer.exe, 00000000.00000003.2261777652.000000000752F000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Selector or media text is not valid.Source range didn't match existing source rangeSource range didn't match existing style source rangeKeyframe key text is not valid.Style text is not valid.Selector or container query text is not valid.CQ Source range didn't match existing style source rangeSelector or supports rule text is not valid.Supports source range didn't match existing source rangeSelector or scope rule text is not valid.Scope source range didn't match existing source range' could not be added in style sheet.The rule '' could not be added in media rule.Cannot insert rule inside rule selector.Cannot insert rule in non-media rule.Source range must be collapsed.Rule text is not valid.Style is read-only.No style rule could be found in given range.No parent stylesheet could be found.Cannot remove rule from non-media rule./\*[^]*?\*/: none; }-webkit-boguz-propertee { -webkit-boguz-propertee : none; } }@keyframes boguzAnim { div {: none; } } { div { @media @container @scope -moz--o--ms-"' %
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: nsis-installer.exe ReversingLabs: Detection: 37%
Source: nsis-installer.exe Virustotal: Detection: 30%
Source: C:\Users\user\Desktop\nsis-installer.exe File read: C:\Users\user\Desktop\nsis-installer.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\nsis-installer.exe "C:\Users\user\Desktop\nsis-installer.exe"
Source: C:\Users\user\Desktop\nsis-installer.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq SerenityTherapyInstaller.exe" /FO csv | %SYSTEMROOT%\System32\find.exe "SerenityTherapyInstaller.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq SerenityTherapyInstaller.exe" /FO csv
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "SerenityTherapyInstaller.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe"
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 --field-trial-handle=1976,i,9719428906805688631,3168165960160999559,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --mojo-platform-channel-handle=2144 --field-trial-handle=1976,i,9719428906805688631,3168165960160999559,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
Source: unknown Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe"
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1912 --field-trial-handle=1916,i,2428637527847521265,8401632774138072131,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --mojo-platform-channel-handle=1808 --field-trial-handle=1916,i,2428637527847521265,8401632774138072131,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1908 --field-trial-handle=1976,i,9719428906805688631,3168165960160999559,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=944 --field-trial-handle=1916,i,2428637527847521265,8401632774138072131,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\Desktop\nsis-installer.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq SerenityTherapyInstaller.exe" /FO csv | %SYSTEMROOT%\System32\find.exe "SerenityTherapyInstaller.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq SerenityTherapyInstaller.exe" /FO csv Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "SerenityTherapyInstaller.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 --field-trial-handle=1976,i,9719428906805688631,3168165960160999559,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --mojo-platform-channel-handle=2144 --field-trial-handle=1976,i,9719428906805688631,3168165960160999559,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log"" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1908 --field-trial-handle=1976,i,9719428906805688631,3168165960160999559,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1912 --field-trial-handle=1916,i,2428637527847521265,8401632774138072131,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --mojo-platform-channel-handle=1808 --field-trial-handle=1916,i,2428637527847521265,8401632774138072131,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=944 --field-trial-handle=1916,i,2428637527847521265,8401632774138072131,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\find.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\SysWOW64\find.exe Section loaded: fsutilext.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: ffmpeg.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: kbdus.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: windows.ui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: windowmanagementapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: inputhost.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: mmdevapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: msmpeg2vdec.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: mfperfhelper.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dxva2.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: msvproc.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: windows.ui.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: windowmanagementapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: inputhost.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: mmdevapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\chcp.com Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\chcp.com Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: msmpeg2vdec.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: mfperfhelper.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dxva2.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: msvproc.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Section loaded: uiautomationcore.dll
Source: C:\Users\user\Desktop\nsis-installer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq SerenityTherapyInstaller.exe" /FO csv
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cfbc383d-9aa0-5771-9485-7b806e8442d5 Jump to behavior
Source: nsis-installer.exe Static file information: File size 78057262 > 1048576
Source: nsis-installer.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: BCC = $(NCC) -nologo -W3 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: nsis-installer.exe, 00000000.00000003.2342229721.0000000002DCA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: del /Q *.exp *.lo *.ilk *.lib *.obj *.ncb *.pdb *.sdf *.suo 2>NUL source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: LTCOMPILE = $(TCC) -Fo$@ -Fd$*.pdb source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: CLEANFILES="$CLEANFILES *.lib *.dll *.pdb *.exp" source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\STATEMENT.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\SRC\STATEMENT.CC source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /OUT:"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.NODE" /INCREMENTAL:NO /NOLOGO KERNEL32.LIB USER32.LIB GDI32.LIB WINSPOOL.LIB COMDLG32.LIB ADVAPI32.LIB SHELL32.LIB OLE32.LIB OLEAUT32.LIB UUID.LIB ODBC32.LIB DELAYIMP.LIB "C:\\USERS\\ADMINISTRATOR\\.ELECTRON-GYP\\24.1.1\\IA32\\NODE.LIB" DELAYIMP.LIB /DELAYLOAD:NODE.EXE /MANIFEST /MANIFESTUAC:"level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG /PDB:"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB" /OPT:REF /OPT:ICF /TLBID:1 /DYNAMICBASE /NXCOMPAT /MACHINE:X86 /SAFESEH /LTCG:INCREMENTAL /ignore:4199 /DLL RELEASE\OBJ\NODE_SQLITE3\WIN_DELAY_LOAD_HOOK.OBJ source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\COMMUNITY\VC\TOOLS\MSVC\14.39.33519\LIB\X86\LIBCMT.I386.PDB source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: nsis-installer.exe, 00000000.00000003.2208092330.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2265396042.00000000050CB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM ) ;; source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: -typedil-fC:\Users\Administrator\Desktop\duvet\src\builds\iL3GxpTZu\source\node_modules\node-gyp\src\win_delay_load_hook.cc-Gs4096-dos-Zi-Z7-W3-pdbrpc-Og-Ob2-Ot-EHs-MT-GS-Gy-FitObjFunc-FitObjData-NoRTTI-FoC:\Users\Administrator\Desktop\duvet\src\builds\iL3GxpTZu\source\node_modules\sqlite3\build\deps\Release\obj\sqlite3\win_delay_load_hook.obj-FdC:\Users\Administrator\Desktop\duvet\src\builds\iL3GxpTZu\source\node_modules\sqlite3\build\Release\sqlite3.pdb-errorreport:queue source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\NODE_SQLITE3.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\SRC\NODE_SQLITE3.CC source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\COMMUNITY\VC\TOOLS\MSVC\14.39.33519\LIB\X86\LIBCPMT.I386.PDB source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2269640861.00000000050C2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: -FdC:\Users\Administrator\Desktop\duvet\src\builds\iL3GxpTZu\source\node_modules\sqlite3\build\Release\sqlite3.pdb source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb`)p) source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2269640861.00000000050C2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\NODE-GYP\SRC\WIN_DELAY_LOAD_HOOK.CC source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: SQLITE3EXEPDB = /pdb:sqlite3sh.pdb source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\COMMUNITY\VC\TOOLS\MSVC\14.39.33519\LIB\X86\LIBVCRUNTIME.I386.PDB source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** rbu_file.pDb!=0, then it is assumed to already be present on the source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libEGL.dll.pdb source: nsis-installer.exe, 00000000.00000003.2208092330.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: BCC = $(NCC) -nologo -W4 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: nsis-installer.exe, 00000000.00000003.2336434743.00000000050C2000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2260611134.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\BACKUP.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\SRC\BACKUP.CC source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\Administrator\Desktop\duvet\src\builds\iL3GxpTZu\source\node_modules\sqlite3\build\Release\sqlite3.pdb source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** for all file descriptors with rbu_file.pDb!=0. If the argument has source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libEGL.dll.pdb source: nsis-installer.exe, 00000000.00000003.2208092330.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** rbu_file.pDb!=0. source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\DATABASE.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\IL3GXPTZU\SOURCE\NODE_MODULES\SQLITE3\SRC\DATABASE.CC source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: nsis-installer.exe, 00000000.00000003.2256512300.0000000004B80000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2338261653.0000000004E41000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2260611134.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2256207119.0000000002E60000.00000004.00001000.00020000.00000000.sdmp
Binary contains a suspicious time stamp
Source: d3dcompiler_47.dll.0.dr Static PE information: 0xBEBD7FD7 [Fri May 29 01:54:31 2071 UTC]
PE file contains sections with non-standard names
Source: libEGL.dll.0.dr Static PE information: section name: .00cfg
Source: libGLESv2.dll.0.dr Static PE information: section name: .00cfg
Source: SerenityTherapyInstaller.exe.0.dr Static PE information: section name: .00cfg
Source: SerenityTherapyInstaller.exe.0.dr Static PE information: section name: .rodata
Source: SerenityTherapyInstaller.exe.0.dr Static PE information: section name: CPADinfo
Source: SerenityTherapyInstaller.exe.0.dr Static PE information: section name: malloc_h
Source: vk_swiftshader.dll.0.dr Static PE information: section name: .00cfg
Source: ffmpeg.dll.0.dr Static PE information: section name: .00cfg
Source: libEGL.dll0.0.dr Static PE information: section name: .00cfg
Source: libGLESv2.dll0.0.dr Static PE information: section name: .00cfg
Source: SerenityTherapyInstaller.exe0.0.dr Static PE information: section name: .00cfg
Source: SerenityTherapyInstaller.exe0.0.dr Static PE information: section name: .rodata
Source: SerenityTherapyInstaller.exe0.0.dr Static PE information: section name: CPADinfo
Source: SerenityTherapyInstaller.exe0.0.dr Static PE information: section name: malloc_h
Source: vk_swiftshader.dll0.0.dr Static PE information: section name: .00cfg
Source: vulkan-1.dll.0.dr Static PE information: section name: .00cfg
Source: vulkan-1.dll0.0.dr Static PE information: section name: .00cfg
Source: ffmpeg.dll0.0.dr Static PE information: section name: .00cfg
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 19_2_05263426 push eax; retf 19_2_05263429
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 19_2_05265428 push eax; mov dword ptr [esp], edx 19_2_0526542C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 19_2_0526A750 push esi; iretd 19_2_0526A75E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 19_2_0526EDF0 push esi; iretd 19_2_0526EDFE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 19_2_0526ECC1 pushad ; iretd 19_2_0526ECCE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 19_2_0526FE37 push esi; iretd 19_2_0526FE46
Drops PE files
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\StdUtils.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\7z-out\vulkan-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File created: C:\Users\user\AppData\Local\Temp\496db3a3-1a7f-4f1b-9fcf-efdaeed463f0.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\SpiderBanner.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\nsExec.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File created: C:\Users\user\AppData\Local\Temp\8643e452-b938-4f7e-b6f6-6c79c3287391.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\7z-out\resources\elevate.exe Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\nsis7z.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\7z-out\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\7z-out\SerenityTherapyInstaller.exe Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\vk_swiftshader.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\7z-out\vk_swiftshader.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\7z-out\ffmpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\7z-out\libEGL.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File created: C:\Users\user\AppData\Local\Temp\e10a37c2-8429-4258-9cd3-d725395e8215.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\vulkan-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\ffmpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\7z-out\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File created: C:\Users\user\AppData\Local\Temp\a5cccf86-07fd-48a4-a9cf-7cd44af85556.tmp.node Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File created: C:\Users\user\AppData\Local\Temp\496db3a3-1a7f-4f1b-9fcf-efdaeed463f0.tmp.node Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File created: C:\Users\user\AppData\Local\Temp\8643e452-b938-4f7e-b6f6-6c79c3287391.tmp.node Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File created: C:\Users\user\AppData\Local\Temp\a5cccf86-07fd-48a4-a9cf-7cd44af85556.tmp.node Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File created: C:\Users\user\AppData\Local\Temp\e10a37c2-8429-4258-9cd3-d725395e8215.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\7z-out\LICENSE.electron.txt Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\LICENSE.electron.txt Jump to behavior
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\Desktop\nsis-installer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SerenityTherapyInstaller.lnk Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Users\user\Desktop\nsis-installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Opens the same file many times (likely Sandbox evasion)
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File opened: \Device\RasAcd count: 67341 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File opened: \Device\RasAcd count: 66586
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3944 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3555
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 508
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1308
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2376
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2388
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 645
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\nsis-installer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\StdUtils.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\vk_swiftshader.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\7z-out\vulkan-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\7z-out\vk_swiftshader.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\496db3a3-1a7f-4f1b-9fcf-efdaeed463f0.tmp.node Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e10a37c2-8429-4258-9cd3-d725395e8215.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\7z-out\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\vulkan-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\7z-out\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\SpiderBanner.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\nsExec.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\a5cccf86-07fd-48a4-a9cf-7cd44af85556.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\7z-out\resources\elevate.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8643e452-b938-4f7e-b6f6-6c79c3287391.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\nsis7z.dll Jump to dropped file
Source: C:\Users\user\Desktop\nsis-installer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss10B5.tmp\7z-out\d3dcompiler_47.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4776 Thread sleep count: 3944 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5588 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4776 Thread sleep count: 286 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4932 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3184 Thread sleep count: 3555 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5608 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6488 Thread sleep count: 508 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3064 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6452 Thread sleep count: 1308 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5648 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 988 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5028 Thread sleep count: 2376 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6536 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5164 Thread sleep count: 84 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3660 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4924 Thread sleep count: 2388 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5588 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6924 Thread sleep count: 89 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6796 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3568 Thread sleep count: 645 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6776 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3756 Thread sleep time: -922337203685477s >= -30000s
Queries keyboard layouts
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\nsis-installer.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File Volume queried: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File Volume queried: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File Volume queried: C:\Users\user FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File Volume queried: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File Volume queried: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File Volume queried: C:\Users\user FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe File Volume queried: C:\Users\user FullSizeInformation
Source: C:\Users\user\Desktop\nsis-installer.exe Code function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_004059CC
Source: C:\Users\user\Desktop\nsis-installer.exe Code function: 0_2_004065FD FindFirstFileW,FindClose, 0_2_004065FD
Source: C:\Users\user\Desktop\nsis-installer.exe Code function: 0_2_00402868 FindFirstFileW, 0_2_00402868
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\nsis-installer.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe File opened: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe File opened: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller Jump to behavior
Source: C:\Users\user\Desktop\nsis-installer.exe File opened: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Jump to behavior
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: VMware Virtual Webcam
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (lines.indexOf('VRTUAL') >= 0 || lines.indexOf('A M I ') >= 0 || lines.indexOf('VirtualBox') >= 0 || lines.indexOf('VMWare') >= 0 || lines.indexOf('Xen') >= 0 || lines.indexOf('Parallels') >= 0) {
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: VMware
Source: nsis-installer.exe, 00000000.00000003.2342441523.0000000002DA4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 1efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdK
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: result.virtualHost = 'Hyper-V';
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: const stdout = execSync('dmesg 2>/dev/null | grep -iE "virtual|hypervisor" | grep -iE "vmware|qemu|kvm|xen" | grep -viE "Nested Virtualization|/virtual/"');
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: if (str.indexOf('tcg') >= 0) { result = 'QEMU'; }
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (lines.indexOf('VMware') >= 0 && !result.virtualHost) {
Source: nsis-installer.exe, 00000000.00000003.2260879693.0000000006810000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: VMware Virtual WebcamMedia.VideoCapture.BlacklistedDeviceGoogle Camera AdapterIP Camera [JPEG/MJPEG]CyberLink Webcam SplitterEpocCamWebcamMax..\..\media\capture\video\video_capture_metrics.ccDevice supports Media.VideoCapture.Device.SupportedPixelFormatMedia.VideoCapture.Device.SupportedResolution
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: case 'vmware':
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (stdout.toString().toLowerCase().indexOf('vmware') >= 0 && !result.virtualHost) {
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (model.startsWith('vmware')) { result.virtualHost = 'VMware'; }
Source: nsis-installer.exe, 00000000.00000003.2335886092.0000000002DAC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f
Source: nsis-installer.exe, 00000000.00000003.2203332099.00000000066D0000.00000004.00001000.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: if (str.indexOf('qemu') >= 0) { result = 'QEMU'; }
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (manufacturer.startsWith('vmware') || manufacturer.startsWith('qemu') || manufacturer === 'xen' || manufacturer.startsWith('parallels')) {
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (manufacturer.startsWith('qemu')) { result.virtualHost = 'KVM'; }
Source: nsis-installer.exe, 00000000.00000003.2265396042.00000000050CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tga
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (manufacturer.startsWith('vmware')) { result.virtualHost = 'VMware'; }
Source: nsis-installer.exe, 00000000.00000003.2335886092.0000000002DAC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: en_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f562
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: (IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) || (IsAndroid() && IsMaliT8xxOrOlder(functions)) || (IsAndroid() && IsMaliG31OrOlder(functions))
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: result.virtualHost = 'VMware';
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (model === 'virtualbox' || model === 'kvm' || model === 'virtual machine' || model === 'bochs' || model.startsWith('vmware') || model.startsWith('qemu') || model.startsWith('parallels')) {
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (stdout.toString().toLowerCase().indexOf('qemu') >= 0 && !result.virtualHost) {
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (result.model.toLowerCase() === 'virtualbox' || result.model.toLowerCase() === 'kvm' || result.model.toLowerCase() === 'virtual machine' || result.model.toLowerCase() === 'bochs' || result.model.toLowerCase().startsWith('vmware') || result.model.toLowerCase().startsWith('droplet')) {
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (model.startsWith('qemu')) { result.virtualHost = 'KVM'; }
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (result.manufacturer.toLowerCase().startsWith('vmware') || result.manufacturer.toLowerCase() === 'xen') {
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: result.virtualHost = 'VMware';
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: result.virtualHost = 'QEMU';
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: result.virtualHost = 'VMware';
Source: nsis-installer.exe, 00000000.00000003.2210859270.0000000006810000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: IIAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTest
Source: nsis-installer.exe, 00000000.00000003.2342518948.0000000002DA6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 1efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#Cd
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: if (str.indexOf('vmware') >= 0) { result = 'VMware'; }
Source: nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: case 'vmware':
Source: nsis-installer.exe, 00000000.00000003.2342035458.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, nsis-installer.exe, 00000000.00000003.2203535595.0000000006AD0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (disksById.indexOf('_QEMU_') >= 0) {
Source: nsis-installer.exe, 00000000.00000003.2265396042.00000000050CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware Screen Codec / VMware Video
Source: C:\Users\user\Desktop\nsis-installer.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\nsis-installer.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Windows\SysWOW64\tasklist.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\nsis-installer.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq SerenityTherapyInstaller.exe" /FO csv | %SYSTEMROOT%\System32\find.exe "SerenityTherapyInstaller.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq SerenityTherapyInstaller.exe" /FO csv Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "SerenityTherapyInstaller.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 --field-trial-handle=1976,i,9719428906805688631,3168165960160999559,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --mojo-platform-channel-handle=2144 --field-trial-handle=1976,i,9719428906805688631,3168165960160999559,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log"" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1908 --field-trial-handle=1976,i,9719428906805688631,3168165960160999559,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1912 --field-trial-handle=1916,i,2428637527847521265,8401632774138072131,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --mojo-platform-channel-handle=1808 --field-trial-handle=1916,i,2428637527847521265,8401632774138072131,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\SerenityTherapyInstaller" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=944 --field-trial-handle=1916,i,2428637527847521265,8401632774138072131,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "c:\users\user\appdata\local\programs\serenitytherapyinstaller\serenitytherapyinstaller.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\serenitytherapyinstaller" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1972 --field-trial-handle=1976,i,9719428906805688631,3168165960160999559,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "c:\users\user\appdata\local\programs\serenitytherapyinstaller\serenitytherapyinstaller.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\serenitytherapyinstaller" --mojo-platform-channel-handle=2144 --field-trial-handle=1976,i,9719428906805688631,3168165960160999559,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "c:\users\user\appdata\local\programs\serenitytherapyinstaller\serenitytherapyinstaller.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\serenitytherapyinstaller" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1912 --field-trial-handle=1916,i,2428637527847521265,8401632774138072131,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "c:\users\user\appdata\local\programs\serenitytherapyinstaller\serenitytherapyinstaller.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\serenitytherapyinstaller" --mojo-platform-channel-handle=1808 --field-trial-handle=1916,i,2428637527847521265,8401632774138072131,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "c:\users\user\appdata\local\programs\serenitytherapyinstaller\serenitytherapyinstaller.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\serenitytherapyinstaller" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1908 --field-trial-handle=1976,i,9719428906805688631,3168165960160999559,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "c:\users\user\appdata\local\programs\serenitytherapyinstaller\serenitytherapyinstaller.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\serenitytherapyinstaller" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=944 --field-trial-handle=1916,i,2428637527847521265,8401632774138072131,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "c:\users\user\appdata\local\programs\serenitytherapyinstaller\serenitytherapyinstaller.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\serenitytherapyinstaller" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1972 --field-trial-handle=1976,i,9719428906805688631,3168165960160999559,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "c:\users\user\appdata\local\programs\serenitytherapyinstaller\serenitytherapyinstaller.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\serenitytherapyinstaller" --mojo-platform-channel-handle=2144 --field-trial-handle=1976,i,9719428906805688631,3168165960160999559,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "c:\users\user\appdata\local\programs\serenitytherapyinstaller\serenitytherapyinstaller.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\serenitytherapyinstaller" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1908 --field-trial-handle=1976,i,9719428906805688631,3168165960160999559,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "c:\users\user\appdata\local\programs\serenitytherapyinstaller\serenitytherapyinstaller.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\serenitytherapyinstaller" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1912 --field-trial-handle=1916,i,2428637527847521265,8401632774138072131,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "c:\users\user\appdata\local\programs\serenitytherapyinstaller\serenitytherapyinstaller.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\serenitytherapyinstaller" --mojo-platform-channel-handle=1808 --field-trial-handle=1916,i,2428637527847521265,8401632774138072131,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Process created: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe "c:\users\user\appdata\local\programs\serenitytherapyinstaller\serenitytherapyinstaller.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\serenitytherapyinstaller" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=944 --field-trial-handle=1916,i,2428637527847521265,8401632774138072131,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: nsis-installer.exe, 00000000.00000003.2261777652.00000000073D7000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: ..\..\third_party\webrtc\modules\desktop_capture\win\window_capture_utils.ccFail to create instance of VirtualDesktopManagerChrome_WidgetWin_ProgmanWindowsDeleteStringWindowsCreateString
Source: SerenityTherapyInstaller.exe, 00000008.00000000.2365305161.0000000007205000.00000002.00000001.01000000.0000000E.sdmp Binary or memory string: ..\..\electron\shell\browser\ui\views\electron_views_delegate_win.ccGetAppbarAutohideEdgesShell_TrayWnd
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\Users\user\AppData\Local VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\resources\app.asar VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\Windows\SysWOW64\cmd.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\Users\user VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\Windows\SysWOW64\cmd.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\Users\user\AppData\Roaming\SerenityTherapyInstaller\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\Desktop\nsis-installer.exe Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_0040338F
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Tries to steal communication platform credentials (via file / registry access)
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe file Attributes Queried: C:\Users\user\AppData\Local\Discord Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe file Attributes Queried: C:\Users\user\AppData\Local\DiscordCanary Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe file Attributes Queried: C:\Users\user\AppData\Local\DiscordPTB Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe file Attributes Queried: C:\Users\user\AppData\Local\Discord
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe file Attributes Queried: C:\Users\user\AppData\Local\DiscordCanary
Source: C:\Users\user\AppData\Local\Programs\SerenityTherapyInstaller\SerenityTherapyInstaller.exe file Attributes Queried: C:\Users\user\AppData\Local\DiscordPTB
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1427113 Sample: nsis-installer.exe Startdate: 17/04/2024 Architecture: WINDOWS Score: 76 75 ipinfo.io 2->75 77 illitmagnetic.site 2->77 83 Antivirus / Scanner detection for submitted sample 2->83 85 Multi AV Scanner detection for dropped file 2->85 87 Multi AV Scanner detection for submitted file 2->87 8 SerenityTherapyInstaller.exe 5 2->8         started        13 SerenityTherapyInstaller.exe 2->13         started        15 nsis-installer.exe 12 195 2->15         started        signatures3 process4 dnsIp5 79 ipinfo.io 34.117.186.192, 443, 49711, 49713 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 8->79 55 8643e452-b938-4f7e...79c3287391.tmp.node, PE32 8->55 dropped 57 496db3a3-1a7f-4f1b...daeed463f0.tmp.node, PE32 8->57 dropped 89 Tries to steal communication platform credentials (via file / registry access) 8->89 91 Opens the same file many times (likely Sandbox evasion) 8->91 17 powershell.exe 21 8->17         started        20 powershell.exe 8->20         started        22 cmd.exe 1 8->22         started        32 7 other processes 8->32 59 e10a37c2-8429-4258...25395e8215.tmp.node, PE32 13->59 dropped 61 a5cccf86-07fd-48a4...d44af85556.tmp.node, PE32 13->61 dropped 24 powershell.exe 13->24         started        26 powershell.exe 13->26         started        28 cmd.exe 13->28         started        35 7 other processes 13->35 63 C:\Users\...\SerenityTherapyInstaller.exe, PE32 15->63 dropped 65 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 15->65 dropped 67 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 15->67 dropped 69 17 other files (none is malicious) 15->69 dropped 30 cmd.exe 1 15->30         started        file6 signatures7 process8 dnsIp9 81 Loading BitLocker PowerShell Module 17->81 37 conhost.exe 17->37         started        39 conhost.exe 20->39         started        45 2 other processes 22->45 41 conhost.exe 24->41         started        43 conhost.exe 26->43         started        47 2 other processes 28->47 49 3 other processes 30->49 71 chrome.cloudflare-dns.com 172.64.41.3, 443, 49712 CLOUDFLARENETUS United States 32->71 51 6 other processes 32->51 73 162.159.61.3, 443, 49715 CLOUDFLARENETUS United States 35->73 53 6 other processes 35->53 signatures10 process11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
34.117.186.192
 ipinfo.io United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
162.159.61.3
 unknown United States
13335 CLOUDFLARENETUS false
172.64.41.3
 chrome.cloudflare-dns.com United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
chrome.cloudflare-dns.com 172.64.41.3 true
ipinfo.io 34.117.186.192 true
illitmagnetic.site unknown unknown