Windows Analysis Report
ShadowFury.exe

Overview

General Information

Sample name: ShadowFury.exe
Analysis ID: 1430162
MD5: ab51093cc7ee1f15124b3e33c5b29ff0
SHA1: 3edb90f6654e68eed56acfb14e8af51cca9c293c
SHA256: c0010bd39bdd04aee00a67a73c839c05c8972e473075a2a22213351efa818ff5
Tags: exe
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for domain / URL
Snort IDS alert for network traffic
Loading BitLocker PowerShell Module
Opens the same file many times (likely Sandbox evasion)
Tries to steal communication platform credentials (via file / registry access)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains sections with non-standard names
Queries keyboard layouts
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Console CodePage Lookup Via CHCP
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

AV Detection
barindex
Multi AV Scanner detection for domain / URL
Source: illitluckygirl.com Virustotal: Detection: 9% Perma Link
Uses 32bit PE files
Source: ShadowFury.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\ShadowFury.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\d8b49fe8-42ea-5121-a0ba-899ad0437a85 Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\7z-out\LICENSE.electron.txt Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Programs\ShadowFury\LICENSE.electron.txt Jump to behavior
Source: ShadowFury.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: BCC = $(NCC) -nologo -W3 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: del /Q *.exp *.lo *.ilk *.lib *.obj *.ncb *.pdb *.sdf *.suo 2>NUL source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: -FdC:\Users\Administrator\Desktop\duvet\src\builds\LYifJXHx8\source\node_modules\sqlite3\build\Release\sqlite3.pdb source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: LTCOMPILE = $(TCC) -Fo$@ -Fd$*.pdb source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\STATEMENT.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\SRC\STATEMENT.CC source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\Administrator\Desktop\duvet\src\builds\LYifJXHx8\source\node_modules\sqlite3\build\Release\sqlite3.pdb source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: CLEANFILES="$CLEANFILES *.lib *.dll *.pdb *.exp" source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: -typedil-fC:\Users\Administrator\Desktop\duvet\src\builds\LYifJXHx8\source\node_modules\node-gyp\src\win_delay_load_hook.cc-Gs4096-dos-Zi-Z7-W3-pdbrpc-Og-Ob2-Ot-EHs-MT-GS-Gy-FitObjFunc-FitObjData-NoRTTI-FoC:\Users\Administrator\Desktop\duvet\src\builds\LYifJXHx8\source\node_modules\sqlite3\build\deps\Release\obj\sqlite3\win_delay_load_hook.obj-FdC:\Users\Administrator\Desktop\duvet\src\builds\LYifJXHx8\source\node_modules\sqlite3\build\Release\sqlite3.pdb-errorreport:queue source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\COMMUNITY\VC\TOOLS\MSVC\14.39.33519\LIB\X86\LIBCMT.I386.PDB source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: ShadowFury.exe, 00000000.00000003.1889380677.0000000005C20000.00000004.00001000.00020000.00000000.sdmp, ShadowFury.exe, 00000000.00000003.1987405093.0000000005025000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM ) ;; source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\NODE_SQLITE3.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\SRC\NODE_SQLITE3.CC source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\COMMUNITY\VC\TOOLS\MSVC\14.39.33519\LIB\X86\LIBCPMT.I386.PDB source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp, ShadowFury.exe, 00000000.00000003.1991955259.0000000005029000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: /OUT:"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.NODE" /INCREMENTAL:NO /NOLOGO KERNEL32.LIB USER32.LIB GDI32.LIB WINSPOOL.LIB COMDLG32.LIB ADVAPI32.LIB SHELL32.LIB OLE32.LIB OLEAUT32.LIB UUID.LIB ODBC32.LIB DELAYIMP.LIB "C:\\USERS\\ADMINISTRATOR\\.ELECTRON-GYP\\24.1.1\\IA32\\NODE.LIB" DELAYIMP.LIB /DELAYLOAD:NODE.EXE /MANIFEST /MANIFESTUAC:"level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG /PDB:"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB" /OPT:REF /OPT:ICF /TLBID:1 /DYNAMICBASE /NXCOMPAT /MACHINE:X86 /SAFESEH /LTCG:INCREMENTAL /ignore:4199 /DLL RELEASE\OBJ\NODE_SQLITE3\WIN_DELAY_LOAD_HOOK.OBJ source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb`)p) source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp, ShadowFury.exe, 00000000.00000003.1991955259.0000000005029000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: SQLITE3EXEPDB = /pdb:sqlite3sh.pdb source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\COMMUNITY\VC\TOOLS\MSVC\14.39.33519\LIB\X86\LIBVCRUNTIME.I386.PDB source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** rbu_file.pDb!=0, then it is assumed to already be present on the source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libEGL.dll.pdb source: ShadowFury.exe, 00000000.00000003.1889380677.0000000005C20000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\DATABASE.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\SRC\DATABASE.CC source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: BCC = $(NCC) -nologo -W4 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: ShadowFury.exe, 00000000.00000003.1982489931.0000000005C20000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\BACKUP.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\SRC\BACKUP.CC source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** for all file descriptors with rbu_file.pDb!=0. If the argument has source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\NODE-GYP\SRC\WIN_DELAY_LOAD_HOOK.CC source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libEGL.dll.pdb source: ShadowFury.exe, 00000000.00000003.1889380677.0000000005C20000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** rbu_file.pDb!=0. source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: ShadowFury.exe, 00000000.00000003.1979571648.0000000004D60000.00000004.00001000.00020000.00000000.sdmp, ShadowFury.exe, 00000000.00000003.1979752685.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, ShadowFury.exe, 00000000.00000003.1982489931.0000000005C20000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\ShadowFury.exe File opened: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe File opened: C:\Users\user\AppData\Local\Programs\ShadowFury Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe File opened: C:\Users\user\AppData\Local\Programs Jump to behavior

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2018316 ET TROJAN Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses 1.1.1.1:53 -> 192.168.2.6:52676
Source: Traffic Snort IDS: 2018316 ET TROJAN Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses 1.1.1.1:53 -> 192.168.2.6:58047
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View IP Address: 162.159.61.3 162.159.61.3
May check the online IP address of the machine
Source: unknown DNS query: name: ipinfo.io
Source: unknown DNS query: name: ipinfo.io
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: V8.MemoryHeapUsedV8.MemoryHeapCommittedmail.google.com.gmaildrive.google.com.docsplus.google.com.plus.inbox.calendarwww.youtube.com.youtube.top10sina.com.cnfacebook.combaidu.comtwitter.comtaobao.comwikipedia equals www.youtube.com (Youtube)
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: ipinfo.io
Source: unknown HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.css
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.jpg
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1085
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1452
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1452expandIntegerPowExpressionsThe
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1512
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1637
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1936
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2046
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2152
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2152skipVSConstantRegisterZeroIn
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2273
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2894
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2978
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3027
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3045
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3246
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3246allowClearForRobustResourceInitSome
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3682
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3682allowES3OnFL100Allow
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3729
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3997
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4214
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4267
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4646
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/482
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007disableDrawBuffersIndexedDisable
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5469
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5577
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658forceGlErrorCheckingForce
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750forceRobustResourceInitForce-enable
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041forceInitShaderVariablesForce-enable
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036dumpShaderSourceWrite
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279cacheCompiledShaderEnable
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7527
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724disableAnisotropicFilteringDisable
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760enableShaderSubstitutionCheck
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761Frontend
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://blog.izs.me)
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://blog.izs.me/)
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://certificates.godaddy.com/repository/gd_intermediate.crt0
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://certificates.godaddy.com/repository100.
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cgit.freedesktop.org/xorg/xserver/tree/COPYING
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cldr.unicode.org/index/downloads
Source: ShadowFury.exe, 00000000.00000003.1983268209.00000000073F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://code.google.com/p/closure-compiler/wiki/SourceMaps
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.google.com/p/smhasher/
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.google.com/p/v8
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1094869
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/110263
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1144207
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1165751
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1165751disableProgramBinaryDisable
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1171371
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1181068
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1181193
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/308366
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/403957
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/550292
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/565179
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/642227
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/642605
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/644669
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/650547
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/672380
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/709351
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/797243
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/809422
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/830046
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/849576
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/883276
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/927470
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/941620
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere
Source: ShadowFury.exe, 00000000.00000003.1983268209.00000000073F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: ShadowFury.exe, 00000000.00000003.1983268209.00000000073F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: ShadowFury.exe, 00000000.00000003.1983268209.00000000073F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.godaddy.com/gds1-20
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://devel.freebsoft.org/speechd
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://developer.android.com/tools/extras/support-library.html
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/common
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/commonnode-set..
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://fedorahosted.org/lohit>
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://fossil-scm.org).
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://freedesktop.org
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://git.linuxtv.org/v4l-utils.git
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.github.io/snappy/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://html4/loose.dtd
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://icl.com/saxon
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://icl.com/saxonorg.apache.xalan.xslt.extensions.RedirectxsltDocumentElem:
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://istanbul-js.org/
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://labs.creativecommons.org/licenses/zero-waive/1.0/us/legalcode>
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://localhosthttp://127.0.0.1object-src
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://mxr.mozilla.org/comm-central/source/mozilla/netwerk/base/src/nsURLParsers.cpp
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://n8.io/)
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://narwhaljs.org)
Source: ShadowFury.exe, 00000000.00000000.1801467075.000000000040A000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.godaddy.com/0J
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://re-becca.org)
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://re-becca.org/)
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://s..
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://scripts.sil.org/OFL
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://source.android.com/
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://source.android.com/compatibility)
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp, ShadowFury.exe, 00000000.00000003.1983268209.00000000073F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://src.chromium.org/viewvc/chrome/trunk/deps/third_party/xz/COPYING
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tukaani.org/xz/
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://userguide.icu-project.org/strings/properties
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://valgrind.org
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://web.archive.org/
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://webkit.org/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://wpad/wpad.dat
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://wpad/wpad.dat..
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp, ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp, ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.chromium.org
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.fossil-scm.org/
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.freedesktop.org/wiki/Software/xdg-user-dirs
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.futurealoof.com)
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.gnu.org/licenses/
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.gutenberg.org/ebooks/53).
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3C//DTD
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.icu-project.org/userguide/posix.html#case_mappings
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.jclark.com/xt
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.linux-usb.org/usb-ids.html
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.midnight-commander.org/browser/lib/tty/key.c
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/MPL/
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.nongnu.org/freebangfont/downloads.html#mukti
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ploscompbiol.org/static/license
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.software-architect.net/blog/article/date/2015/06/12/-826c6e5052.html
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/compile.html).
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/src/info/6709574d2a
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/src/info/f2369304e4
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/tclsqlite.html
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.squid-cache.org/Doc/config/half_closed_clients/
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.strongtalk.org/
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.suitable.com
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.suitable.com/tools/smslib.html
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.suitable.com/tools/smslib.html>
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.unicode.org
Source: ShadowFury.exe, 00000000.00000003.1862439762.0000000005E20000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.unicode.org/copyright.html
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.webrtc.org
Source: ShadowFury.exe, 00000004.00000000.2064453399.0000000007462000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: http://www.xfa.com/schema/xfa-package/
Source: ShadowFury.exe, 00000004.00000000.2064453399.0000000007462000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: http://www.xfa.org/schema/xci/
Source: ShadowFury.exe, 00000004.00000000.2064453399.0000000007462000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: http://www.xfa.org/schema/xdc/
Source: ShadowFury.exe, 00000004.00000000.2064453399.0000000007462000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: http://www.xfa.org/schema/xfa-connection-set/
Source: ShadowFury.exe, 00000004.00000000.2064453399.0000000007462000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: http://www.xfa.org/schema/xfa-data/
Source: ShadowFury.exe, 00000004.00000000.2064453399.0000000007462000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: http://www.xfa.org/schema/xfa-data/1.0/
Source: ShadowFury.exe, 00000004.00000000.2064453399.0000000007462000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: http://www.xfa.org/schema/xfa-data/1.0/xmlns:xfa
Source: ShadowFury.exe, 00000004.00000000.2064453399.0000000007462000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: http://www.xfa.org/schema/xfa-form/
Source: ShadowFury.exe, 00000004.00000000.2064453399.0000000007462000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: http://www.xfa.org/schema/xfa-locale-set/
Source: ShadowFury.exe, 00000004.00000000.2064453399.0000000007462000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: http://www.xfa.org/schema/xfa-package/
Source: ShadowFury.exe, 00000004.00000000.2064453399.0000000007462000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: http://www.xfa.org/schema/xfa-source-set/
Source: ShadowFury.exe, 00000004.00000000.2064453399.0000000007462000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: http://www.xfa.org/schema/xfa-template/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xmlsoft.org/XSLT/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xmlsoft.org/XSLT/namespace
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xmlsoft.org/XSLT/namespacehttp://www.jclark.com/xtxsl:key
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xmlsoft.org/XSLT/xsltNewExtDef
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://zlib.net/
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4674
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4849
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5140
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5536
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246enableCaptureLimitsSet
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7405
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/upload
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/uploadhttps://beacons.gvt2.com/domainreliability/uplo
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons.gvt2.com/domainreliability/upload
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons2.gvt2.com/domainreliability/upload
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons3.gvt2.com/domainreliability/upload
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons4.gvt2.com/domainreliability/upload
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons5.gvt2.com/domainreliability/upload
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons5.gvt3.com/domainreliability/upload
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bit.ly/3rpDuEX.
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bit.ly/3rpDuEX.WebBundleURLLoaderFactory::OnResponseParsedInvalid
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.htmlMixed
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=10201
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=107106
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=745678
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.android.clients.google.com/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.bigcache.googleapis.com/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.doc-0-0-sj.sj.googleusercontent.com/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.docs.google.com/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.drive.google.com/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.googlesyndication.com/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.pack.google.com/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.play.google.com/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.youtube.com/
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://chromestatus.com/feature/5105856067141632.
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://chromestatus.com/feature/5463833265045504.
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://chromestatus.com/feature/5463833265045504.Found
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://chromium.googlesource.com/angle/angle/
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp, ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chromium.googlesource.com/vulkan-deps/
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chromium.googlesource.com/webm/libwebm
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chromium.googlesource.com/webm/libwebp
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/domainreliability/upload
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#clear
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#console-namespace
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#count
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#count-map
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#countreset
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#table
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1038223.
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1042393
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1046462
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1060012
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1091824
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1137851
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1154140
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1300575
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1356053
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1412729
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/593024
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/593024selectViewInGeometryShaderThe
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/619103.
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/619103.Subsequence
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/650547
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/650547callClearTwiceUsing
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/655534
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/655534useSystemMemoryForConstantBuffersCopying
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/705865
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/710443
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/811661
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/848952
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/927119
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/927119..
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/981419
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/v8/7848
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://creativecommons.org/licenses/by/3.0/
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://cs.chromium.org/chromium/src/v8/tools/SourceMap.js?rcl=dd10454c1d
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling.
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7231#section-6.4
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7238
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dejavu-fonts.github.io/Download.html
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.chrome.com/blog/enabling-shared-array-buffer/
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.chrome.com/blog/immutable-document-domain/
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.chrome.com/docs/extensions/mv3/cross-origin-isolation/.
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/SpiderMonkey/Parser_API
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/PerformanceResourceTiming
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Equality_comparisons_and_sameness#Loose_equa
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://developers.google.com/android/guides/setup
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developers.google.com/web/updates/2016/08/removing-document-write
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://elinux.org/RPI_vcgencmd_usage
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://elinux.org/RPi_HardwareHistory
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org/#encode-and-enqueue-a-chunk
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org/#encode-and-flush
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org/#textdecoder
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org/#textencoder
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://esdiscuss.org/topic/isconstructor#content-11
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fetch.spec.whatwg.org/
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fetch.spec.whatwg.org/#fetch-timing-info
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gcp.gvt2.com/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gcp.gvt6.com/
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gist.github.com/XVilka/8346728#gistcomment-2823421
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Buzut)
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Cyan4973/xxHash
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/GoogleChromeLabs/text-fragments-polyfill
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Cross
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers.git
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools.git
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/Vulkan-Headers
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/Vulkan-Loader
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Squirrel/Squirrel.Mac
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/TooTallNate/util-deprecate
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.border-boxcontent-bo
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/WICG/scheduling-apis
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/WICG/shared-element-transitions/blob/main/debugging_overflow_on_images.md.
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/WICG/view-transitions/blob/main/debugging_overflow_on_images.md
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/WebAssembly/esm-integration/issues/42
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/aawc/unrar.git
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/acornjs/acorn/blob/master/acorn/src/identifier.js#L23
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/acornjs/acorn/issues/575
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/addaleax/eventemitter-asyncresource
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/ansi-regex/blob/HEAD/index.js
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/supports-color
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorith
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/csy1983)
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/electron/electron/issues/18397.
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/electron/electron/issues/18397.Module
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/estree/estree/blob/a27003adf4fd7bfad44de9cef372a2eacd527b1c/es5.md#regexpliteral
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/glegrain)
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.js
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/startSES.js
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/closure-compiler/wiki/Source-Maps
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/diff-match-patch/tree/master/javascript
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/distributed_point_functions
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/google-api-cpp-client/
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/ruy
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/ukey2
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/woff2
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/wuffs-mirror-release-c
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/xnnpack
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/heycam/webidl/pull/946.
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/iarna/unique-filename
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/iarna/unique-filename.git
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/iarna/wide-align
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/color-support.
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/minipass.git
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/node-tar.git
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/yallist.git
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/joyent/node
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/joyent/node/issues/3295.
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/lapsio)
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/libuv/libuv/pull/1501.
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/pump
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/tar-fs
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/tar-fs.git
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/tar-stream
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/tar-stream.git
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mikeal/tunnel-agent
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mysticatea/abort-controller
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node-v0.x-archive/issues/2876.
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/commit/ec2822adaad76b126b5cccdeaa1addf2376c9aa6
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/10673
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/13435
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/13581
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/19009
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/2006
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/3392
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/34532
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/35452
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/35475
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/35862
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/35981
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/39707
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/39758
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/45699
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/12342
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/12607
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/13870#discussion_r124515293
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/21313
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/26334.
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/30380#issuecomment-552948364
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/30958
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/32887
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/33515.
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/33661
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/3394
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/34010
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/34103#issuecomment-652002364
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/34375
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/34385
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/35941
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/35949#issuecomment-722496598
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/36061#discussion_r533718029
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/38248
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/38433#issuecomment-828426932
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/38614)
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/43714
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/44952
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/46161
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/string_decoder
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/node-semver.git
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/node-tar/blob/51b6627a1f357d2eb433e7378e5f05e83b7aa6cd/lib/header.js#L349
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/node-tar/issues/183
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/node-tar/pull/187
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/ssri
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/wrappy
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/richy24)
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/sebhildebrandt/systeminformation.git
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/sponsors/sindresorhus
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/standard-things/esm/issues/821.
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tc39/ecma262/blob/HEAD/LICENSE.md
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tc39/ecma262/issues/1209
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tc39/proposal-iterator-helpers/issues/169
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tc39/proposal-ses/blob/e5271cc42a257a05dcae2fd94713ed2f46c08620/shim/src/freeze.j
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tc39/proposal-weakrefs
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/models
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/tensorflow
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/text.git
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/tflite-support
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/ServiceWorker/issues/1356.
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/ServiceWorker/issues/1356.v8.produceCachev8.produceModuleCacheV8.ProduceCodeC
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/gamepad/pull/120
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/gamepad/pull/120Access
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-featuresDeviceOri
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/webappsec-trusted-types/wiki/Trusted-Types-for-function-constructor
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/wasdk/wasmparser
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/web-animations/web-animations-js
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gitlab.freedesktop.org/wayland/weston
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gitlab.freedesktop.org/xdg/xdgmime
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gitlab.freedesktop.org/xorg/proto/xproto/
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/LdLk22
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/LdLk22MEDIA_ELEMENT_ERROR:
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/LdLk22Media
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/rStTGz
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/t5IS6M).
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/xX8pDD
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/xX8pDDplay()
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/ximf56
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/ximf56Iframe
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gle/chrome-insecure-origins
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://google-analytics.com/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://googlevideo.com/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gvt1.com/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gvt2.com/
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gvt6.com/
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#Replaceable
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#define-the-operations
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#dfn-class-string
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#dfn-default-iterator-object
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#dfn-iterator-prototype-object
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-interfaces
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-iterable
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-iterable-entries
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-iterators
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-namespaces
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-operations
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-stringifier
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequentlyOut
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/dom.html#custom-data-attribute.
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#forgiving-base64
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#forgiving-base64-decode
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://invisible-island.net/ncurses/terminfo.ti.html#toc-_Specials
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903emulatePixelLocalStorageEmulate
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: ShadowFury.exe, 00000000.00000003.1983268209.00000000073F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://jimmy.warting.se/opensource
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://linux.die.net/man/1/dircolors).
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://no-color.org/
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode).
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/fs.html
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/fs.html#fs_stat_time_values)
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/http.html#http_class_http_incomingmessage
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/download/release/v18.14.0/node-v18.14.0-headers.tar.gz
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/download/release/v18.14.0/node-v18.14.0.tar.gz
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/download/release/v18.14.0/node-v18.14.0.tar.gzhttps://nodejs.org/download/release
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/download/release/v18.14.0/win-x86/node.lib
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/en/docs/inspector
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/en/docs/inspectorFor
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/static/images/favicons/favicon.ico
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/static/images/favicons/favicon.icofaviconUrldevtoolsFrontendUrldevtoolsFrontendUr
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pagure.io/lohit
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://plus-innovations.com)
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html).
Source: ShadowFury.exe, 00000004.00000000.2064453399.0000000007462000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://semver.org/
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sindresorhus.com
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sindresorhus.com)
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/site/gaviotachessengine/Home/endgame-tablebases-1
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://source.chromium.org/chromium/chromium/src/
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/wtl/files/WTL%2010/
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sourcemaps.info/spec.html
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/08a0d6d9bf
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/157dc791df
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/206d99a16dd9212f
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/24083b579d.
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/2d76f2bcf65d256a
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/36937b197273d403
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/51e6959f61
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/68d284c86b082c3e
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/726219164b
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/83cb4a95a0
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/b40696f50145d21c
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/eb8613976a
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/src/info/0f0428096f17252a
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/src/info/b043a54c3de54b28
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/src/info/c94369cae9b561b1
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/src/info/ce8717f0885af975
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/src/info/fd76310a5e843e07
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com/
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/a/5501711/3561
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://swiftshader.googlesource.com/SwiftShader
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://systeminformation.io
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.es/ecma262/#sec-%typedarray%-intrinsic-object
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.es/ecma262/#sec-timeclip
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.es/ecma262/#table-typeof-operator-results
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-%typedarray%.of
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-object.prototype.tostring
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://testanything.org/tap-version-14-specification.html
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://testanything.org/tap-version-14-specification.html#subtests
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2397#section-2
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc3986#section-3.2.2
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc5234#appendix-B.1
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc6455#section-1.3
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.2
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.6
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7540#section-8.1.2.5
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#cannot-have-a-username-password-port
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-url
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-url-origin
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-parser
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-serializer
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#forbidden-host-code-point
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#special-scheme
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#url
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#url-serializing
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams-stringification-behavior
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8.dev/blog/v8-release-89
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/manifest/#installability-signals
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/resource-timing/#dfn-mark-resource-timing
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/resource-timing/#dfn-setup-the-resource-timing-entry
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/resource-timing/#dom-performance-setresourcetimingbuffersize
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#grammardef-option-expression
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#integrity-metadata-description
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#parse-metadata
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#the-integrity-attribute
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://webassembly.github.io/spec/web-api
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://webidl.spec.whatwg.org/#es-dictionary
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://wiki.ubuntuusers.de/lsblk/
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.buymeacoffee.com/systeminfo
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/4664843055398912
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5082396709879808
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5093566007214080
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5636954674692096
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5718547946799104
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5738264052891648
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5745543795965952
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5745543795965952unload/beforeunload
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5851021045661696.
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5851021045661696.The
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/6662647093133312
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/6662647093133312InputDeviceCapabilities
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromium.org/blink/origin-trials/portals.
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromium.org/blink/origin-trials/portals.The
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.dmtf.org/sites/default/files/standards/documents/DSP0134_3.4.0a.pdf
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-line-terminators
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-promise.all
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Alternative
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Atom
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClass
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClassEscape
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtom
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtomNoDash
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassRanges
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlEscape
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlLetter
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalDigits
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalEscape
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Disjunction
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Hex4Digits
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigit
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigits
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexEscapeSequence
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRanges
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRangesNoDash
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-OctalDigit
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Pattern
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-PatternCharacter
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Quantifier
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-QuantifierPrefix
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-RegExpUnicodeEscapeSequence
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-SyntaxCharacter
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Assertion
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-AtomEscape
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-CharacterEscape
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassControlLetter
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassEscape
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedAtom
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedPatternCharacter
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-IdentityEscape
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-InvalidBracedQuantifier
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-LegacyOctalEscapeSequence
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Term
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-term
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: ShadowFury.exe, 00000004.00000000.2064453399.0000000007462000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://www.googleapis.com/spelling/v%d/spelling/check?key=%s
Source: ShadowFury.exe, 00000004.00000000.2064453399.0000000007462000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://www.googleapis.com/spelling/v%d/spelling/check?key=%serrorspellingCheckResponse.misspellings
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.iana.org/assignments/tls-extensiontype-values
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.inetdaemon.com/tutorials/internet/ip/routing/default_route.shtml
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.raspberrypi.org/documentation/hardware/raspberrypi/revision-codes/README.md
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.rfc-editor.org/rfc/rfc9110#section-5.2
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.sqlite.org/src/info/083f9e6270).
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.sqlite.org/src/info/908f001483982c43
Source: ShadowFury.exe, 00000000.00000003.1883935339.0000000005920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.sqlite.org/src/info/bba7b69f9849b5bf
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.swift.org/download/
Source: ShadowFury.exe, 00000000.00000003.1983017593.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt
Source: ShadowFury.exe, 00000000.00000003.1993745329.0000000005020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.unicode.org/copyright.html.
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://xhr.spec.whatwg.org/.
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Installs a raw input device (often for capturing keystrokes)
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: RegisterRawInputDevices() failed for RIDEV_REMOVE memstr_52dc8a5c-3
Enables security privileges
Source: C:\Users\user\Desktop\ShadowFury.exe Process token adjusted: Security Jump to behavior
PE / OLE file has an invalid certificate
Source: ShadowFury.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dllb! vs ShadowFury.exe
Source: ShadowFury.exe, 00000000.00000003.1991955259.0000000005029000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dllb! vs ShadowFury.exe
Source: ShadowFury.exe, 00000000.00000003.1889380677.0000000005C20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibEGL.dllb! vs ShadowFury.exe
Source: ShadowFury.exe, 00000000.00000003.1889380677.0000000005C20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs ShadowFury.exe
Source: ShadowFury.exe, 00000000.00000003.1985878929.0000000005026000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs ShadowFury.exe
Source: ShadowFury.exe, 00000000.00000003.1982489931.0000000005C20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevk_swiftshader.dll, vs ShadowFury.exe
Source: ShadowFury.exe, 00000004.00000000.2064453399.0000000007462000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: ..\..\base\file_version_info_win.ccCreateFileVersionInfoWinCompanyNameCompanyShortNameInternalNameProductNameProductShortNameProductVersionFileDescriptionFileVersionOriginalFilenameSpecialBuild\StringFileInfo\%04x%04x\%ls\VarFileInfo\Translation\..\..\base\files\file_enumerator_win.cc..\..\base\files\file_path_watcher_win.ccUpdateWatchDestroyWatchSetupWatchHandleOnObjectSignaled( vs ShadowFury.exe
Uses 32bit PE files
Source: ShadowFury.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engine Classification label: mal68.spyw.evad.winEXE@59/132@35/2
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Users\user\Desktop\ShadowFury.exe Mutant created: \Sessions\1\BaseNamedObjects\d8b49fe8-42ea-5121-a0ba-899ad0437a85
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1848:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2088:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7744:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2000:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6560:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7800:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7908:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7784:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7856:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6556:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7872:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6804:120:WilError_03
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\nsqEB24.tmp Jump to behavior
Source: ShadowFury.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\ShadowFury.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: ShadowFury.exe, 00000000.00000003.1983268209.000000000768F000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Selector or media text is not valid.Source range didn't match existing source rangeSource range didn't match existing style source rangeKeyframe key text is not valid.Style text is not valid.Selector or container query text is not valid.CQ Source range didn't match existing style source rangeSelector or supports rule text is not valid.Supports source range didn't match existing source rangeSelector or scope rule text is not valid.Scope source range didn't match existing source range' could not be added in style sheet.The rule '' could not be added in media rule.Cannot insert rule inside rule selector.Cannot insert rule in non-media rule.Source range must be collapsed.Rule text is not valid.Style is read-only.No style rule could be found in given range.No parent stylesheet could be found.Cannot remove rule from non-media rule./\*[^]*?\*/: none; }-webkit-boguz-propertee { -webkit-boguz-propertee : none; } }@keyframes boguzAnim { div {: none; } } { div { @media @container @scope -moz--o--ms-"' %
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: C:\Users\user\Desktop\ShadowFury.exe File read: C:\Users\user\Desktop\ShadowFury.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\ShadowFury.exe "C:\Users\user\Desktop\ShadowFury.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe"
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\ShadowFury" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 --field-trial-handle=1976,i,5983286272222929098,2111862597278059386,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\ShadowFury" --mojo-platform-channel-handle=2136 --field-trial-handle=1976,i,5983286272222929098,2111862597278059386,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: unknown Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe"
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\ShadowFury" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 --field-trial-handle=1972,i,18180359127166526210,17872614602038801051,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\ShadowFury" --mojo-platform-channel-handle=2164 --field-trial-handle=1972,i,18180359127166526210,17872614602038801051,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\ShadowFury" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1976,i,5983286272222929098,2111862597278059386,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\ShadowFury" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1444 --field-trial-handle=1972,i,18180359127166526210,17872614602038801051,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\ShadowFury" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 --field-trial-handle=1976,i,5983286272222929098,2111862597278059386,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\ShadowFury" --mojo-platform-channel-handle=2136 --field-trial-handle=1976,i,5983286272222929098,2111862597278059386,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log"" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\ShadowFury" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1976,i,5983286272222929098,2111862597278059386,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\ShadowFury" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 --field-trial-handle=1972,i,18180359127166526210,17872614602038801051,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\ShadowFury" --mojo-platform-channel-handle=2164 --field-trial-handle=1972,i,18180359127166526210,17872614602038801051,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log"" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: ffmpeg.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: kbdus.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: windows.ui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: windowmanagementapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: inputhost.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mmdevapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: ffmpeg.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mf.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mfplat.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: rtworkq.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: msmpeg2vdec.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mfperfhelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dxva2.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: msvproc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: ffmpeg.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: kbdus.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: ffmpeg.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: kbdus.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: windows.ui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: windowmanagementapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: inputhost.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mmdevapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\chcp.com Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: msmpeg2vdec.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mfperfhelper.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dxva2.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: msvproc.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: msmpeg2vdec.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: mfperfhelper.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dxva2.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: msvproc.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: d3d12core.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: dxilconv.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: d3dscache.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Section loaded: uiautomationcore.dll
Source: C:\Users\user\Desktop\ShadowFury.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\d8b49fe8-42ea-5121-a0ba-899ad0437a85 Jump to behavior
Source: ShadowFury.exe Static file information: File size 78038194 > 1048576
Source: ShadowFury.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: BCC = $(NCC) -nologo -W3 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: del /Q *.exp *.lo *.ilk *.lib *.obj *.ncb *.pdb *.sdf *.suo 2>NUL source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: -FdC:\Users\Administrator\Desktop\duvet\src\builds\LYifJXHx8\source\node_modules\sqlite3\build\Release\sqlite3.pdb source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: LTCOMPILE = $(TCC) -Fo$@ -Fd$*.pdb source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\STATEMENT.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\SRC\STATEMENT.CC source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\Administrator\Desktop\duvet\src\builds\LYifJXHx8\source\node_modules\sqlite3\build\Release\sqlite3.pdb source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: CLEANFILES="$CLEANFILES *.lib *.dll *.pdb *.exp" source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: -typedil-fC:\Users\Administrator\Desktop\duvet\src\builds\LYifJXHx8\source\node_modules\node-gyp\src\win_delay_load_hook.cc-Gs4096-dos-Zi-Z7-W3-pdbrpc-Og-Ob2-Ot-EHs-MT-GS-Gy-FitObjFunc-FitObjData-NoRTTI-FoC:\Users\Administrator\Desktop\duvet\src\builds\LYifJXHx8\source\node_modules\sqlite3\build\deps\Release\obj\sqlite3\win_delay_load_hook.obj-FdC:\Users\Administrator\Desktop\duvet\src\builds\LYifJXHx8\source\node_modules\sqlite3\build\Release\sqlite3.pdb-errorreport:queue source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\COMMUNITY\VC\TOOLS\MSVC\14.39.33519\LIB\X86\LIBCMT.I386.PDB source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: ShadowFury.exe, 00000000.00000003.1889380677.0000000005C20000.00000004.00001000.00020000.00000000.sdmp, ShadowFury.exe, 00000000.00000003.1987405093.0000000005025000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM ) ;; source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\NODE_SQLITE3.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\SRC\NODE_SQLITE3.CC source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\COMMUNITY\VC\TOOLS\MSVC\14.39.33519\LIB\X86\LIBCPMT.I386.PDB source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp, ShadowFury.exe, 00000000.00000003.1991955259.0000000005029000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: /OUT:"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.NODE" /INCREMENTAL:NO /NOLOGO KERNEL32.LIB USER32.LIB GDI32.LIB WINSPOOL.LIB COMDLG32.LIB ADVAPI32.LIB SHELL32.LIB OLE32.LIB OLEAUT32.LIB UUID.LIB ODBC32.LIB DELAYIMP.LIB "C:\\USERS\\ADMINISTRATOR\\.ELECTRON-GYP\\24.1.1\\IA32\\NODE.LIB" DELAYIMP.LIB /DELAYLOAD:NODE.EXE /MANIFEST /MANIFESTUAC:"level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG /PDB:"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB" /OPT:REF /OPT:ICF /TLBID:1 /DYNAMICBASE /NXCOMPAT /MACHINE:X86 /SAFESEH /LTCG:INCREMENTAL /ignore:4199 /DLL RELEASE\OBJ\NODE_SQLITE3\WIN_DELAY_LOAD_HOOK.OBJ source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb`)p) source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp, ShadowFury.exe, 00000000.00000003.1991955259.0000000005029000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: SQLITE3EXEPDB = /pdb:sqlite3sh.pdb source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\COMMUNITY\VC\TOOLS\MSVC\14.39.33519\LIB\X86\LIBVCRUNTIME.I386.PDB source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** rbu_file.pDb!=0, then it is assumed to already be present on the source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libEGL.dll.pdb source: ShadowFury.exe, 00000000.00000003.1889380677.0000000005C20000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\DATABASE.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\SRC\DATABASE.CC source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: BCC = $(NCC) -nologo -W4 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: ShadowFury.exe, 00000000.00000003.1982489931.0000000005C20000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\BACKUP.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\SRC\BACKUP.CC source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** for all file descriptors with rbu_file.pDb!=0. If the argument has source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /c /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\SRC" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\.ELECTRON-GYP\24.1.1\DEPS\V8\INCLUDE" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3440200" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=8 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D SQLITE_ENABLE_MATH_FUNCTIONS /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /analyze- /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\DUVET\SRC\BUILDS\LYIFJXHX8\SOURCE\NODE_MODULES\NODE-GYP\SRC\WIN_DELAY_LOAD_HOOK.CC source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libEGL.dll.pdb source: ShadowFury.exe, 00000000.00000003.1889380677.0000000005C20000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ** rbu_file.pDb!=0. source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: ShadowFury.exe, 00000000.00000003.1979571648.0000000004D60000.00000004.00001000.00020000.00000000.sdmp, ShadowFury.exe, 00000000.00000003.1979752685.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, ShadowFury.exe, 00000000.00000003.1982489931.0000000005C20000.00000004.00001000.00020000.00000000.sdmp
Binary contains a suspicious time stamp
Source: d3dcompiler_47.dll.0.dr Static PE information: 0xBEBD7FD7 [Fri May 29 01:54:31 2071 UTC]
PE file contains sections with non-standard names
Source: libGLESv2.dll.0.dr Static PE information: section name: .00cfg
Source: ShadowFury.exe.0.dr Static PE information: section name: .00cfg
Source: ShadowFury.exe.0.dr Static PE information: section name: .rodata
Source: ShadowFury.exe.0.dr Static PE information: section name: CPADinfo
Source: ShadowFury.exe.0.dr Static PE information: section name: malloc_h
Source: vk_swiftshader.dll.0.dr Static PE information: section name: .00cfg
Source: vulkan-1.dll.0.dr Static PE information: section name: .00cfg
Source: ffmpeg.dll.0.dr Static PE information: section name: .00cfg
Source: libEGL.dll.0.dr Static PE information: section name: .00cfg
Source: libGLESv2.dll0.0.dr Static PE information: section name: .00cfg
Source: ShadowFury.exe0.0.dr Static PE information: section name: .00cfg
Source: ShadowFury.exe0.0.dr Static PE information: section name: .rodata
Source: ShadowFury.exe0.0.dr Static PE information: section name: CPADinfo
Source: ShadowFury.exe0.0.dr Static PE information: section name: malloc_h
Source: vk_swiftshader.dll0.0.dr Static PE information: section name: .00cfg
Source: vulkan-1.dll0.0.dr Static PE information: section name: .00cfg
Source: ffmpeg.dll0.0.dr Static PE information: section name: .00cfg
Source: libEGL.dll0.0.dr Static PE information: section name: .00cfg
Drops PE files
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\7z-out\vulkan-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\7z-out\resources\elevate.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\c72e6d37-050a-4632-91c0-63b85d93d972.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\7z-out\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Programs\ShadowFury\vk_swiftshader.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Programs\ShadowFury\ffmpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Programs\ShadowFury\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\7z-out\vk_swiftshader.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\ece2b052-aa6a-477b-a28f-4a0581807657.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\StdUtils.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Programs\ShadowFury\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Programs\ShadowFury\vulkan-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\7z-out\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Programs\ShadowFury\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\SpiderBanner.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\nsis7z.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\6f9c7dcb-c5ec-4d75-b81c-93e1fcff8c95.tmp.node Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\65009a31-e18f-4331-be2b-a374113ace84.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\7z-out\ffmpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\7z-out\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\7z-out\ShadowFury.exe Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\65009a31-e18f-4331-be2b-a374113ace84.tmp.node Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\6f9c7dcb-c5ec-4d75-b81c-93e1fcff8c95.tmp.node Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\c72e6d37-050a-4632-91c0-63b85d93d972.tmp.node Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\ece2b052-aa6a-477b-a28f-4a0581807657.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\7z-out\LICENSE.electron.txt Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Local\Programs\ShadowFury\LICENSE.electron.txt Jump to behavior
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShadowFury.lnk Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\ShadowFury.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShadowFury.lnk Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Users\user\Desktop\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Opens the same file many times (likely Sandbox evasion)
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File opened: \Device\RasAcd count: 61641 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File opened: \Device\RasAcd count: 55052 Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3101 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 379 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2725
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 411
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1246
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3060
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3083
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 935
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\7z-out\vulkan-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\7z-out\resources\elevate.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\c72e6d37-050a-4632-91c0-63b85d93d972.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\7z-out\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\ShadowFury\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\ShadowFury\vk_swiftshader.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\7z-out\vk_swiftshader.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ece2b052-aa6a-477b-a28f-4a0581807657.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\StdUtils.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\ShadowFury\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\7z-out\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\ShadowFury\vulkan-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\ShadowFury\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\SpiderBanner.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\nsis7z.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\6f9c7dcb-c5ec-4d75-b81c-93e1fcff8c95.tmp.node Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\65009a31-e18f-4331-be2b-a374113ace84.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\7z-out\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\ShadowFury.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqECAB.tmp\System.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7292 Thread sleep count: 3101 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7360 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7292 Thread sleep count: 379 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7332 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7256 Thread sleep count: 2725 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7364 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7176 Thread sleep count: 411 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7312 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7308 Thread sleep count: 1246 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7368 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7344 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8060 Thread sleep count: 3060 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1284 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8068 Thread sleep count: 324 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 412 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8112 Thread sleep count: 3083 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5888 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8112 Thread sleep count: 218 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8184 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8164 Thread sleep count: 935 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2496 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1548 Thread sleep time: -922337203685477s >= -30000s
Queries keyboard layouts
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\ShadowFury.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File Volume queried: C:\Users\user\AppData\Local\Programs\ShadowFury FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File Volume queried: C:\Users\user\AppData\Local\Programs\ShadowFury FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File Volume queried: C:\Users\user FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File Volume queried: C:\Users\user FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File Volume queried: C:\Users\user\AppData\Local\Programs\ShadowFury FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File Volume queried: C:\Users\user\AppData\Local\Programs\ShadowFury FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File Volume queried: C:\Users\user FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe File Volume queried: C:\Users\user FullSizeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\ShadowFury.exe File opened: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe File opened: C:\Users\user\AppData\Local\Programs\ShadowFury Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\Users\user\Desktop\ShadowFury.exe File opened: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: VMware Virtual Webcam
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (lines.indexOf('VRTUAL') >= 0 || lines.indexOf('A M I ') >= 0 || lines.indexOf('VirtualBox') >= 0 || lines.indexOf('VMWare') >= 0 || lines.indexOf('Xen') >= 0 || lines.indexOf('Parallels') >= 0) {
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: VMware
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: result.virtualHost = 'Hyper-V';
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: const stdout = execSync('dmesg 2>/dev/null | grep -iE "virtual|hypervisor" | grep -iE "vmware|qemu|kvm|xen" | grep -viE "Nested Virtualization|/virtual/"');
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (str.indexOf('tcg') >= 0) { result = 'QEMU'; }
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (lines.indexOf('VMware') >= 0 && !result.virtualHost) {
Source: ShadowFury.exe, 00000000.00000003.1982753666.0000000006970000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: VMware Virtual WebcamMedia.VideoCapture.BlacklistedDeviceGoogle Camera AdapterIP Camera [JPEG/MJPEG]CyberLink Webcam SplitterEpocCamWebcamMax..\..\media\capture\video\video_capture_metrics.ccDevice supports Media.VideoCapture.Device.SupportedPixelFormatMedia.VideoCapture.Device.SupportedResolution
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: case 'vmware':
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (stdout.toString().toLowerCase().indexOf('vmware') >= 0 && !result.virtualHost) {
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (model.startsWith('vmware')) { result.virtualHost = 'VMware'; }
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (str.indexOf('qemu') >= 0) { result = 'QEMU'; }
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (manufacturer.startsWith('vmware') || manufacturer.startsWith('qemu') || manufacturer === 'xen' || manufacturer.startsWith('parallels')) {
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (manufacturer.startsWith('qemu')) { result.virtualHost = 'KVM'; }
Source: ShadowFury.exe, 00000000.00000003.1987405093.0000000005025000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tga
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (manufacturer.startsWith('vmware')) { result.virtualHost = 'VMware'; }
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: (IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) || (IsAndroid() && IsMaliT8xxOrOlder(functions)) || (IsAndroid() && IsMaliG31OrOlder(functions))
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: result.virtualHost = 'VMware';
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (model === 'virtualbox' || model === 'kvm' || model === 'virtual machine' || model === 'bochs' || model.startsWith('vmware') || model.startsWith('qemu') || model.startsWith('parallels')) {
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (stdout.toString().toLowerCase().indexOf('qemu') >= 0 && !result.virtualHost) {
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (result.model.toLowerCase() === 'virtualbox' || result.model.toLowerCase() === 'kvm' || result.model.toLowerCase() === 'virtual machine' || result.model.toLowerCase() === 'bochs' || result.model.toLowerCase().startsWith('vmware') || result.model.toLowerCase().startsWith('droplet')) {
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (model.startsWith('qemu')) { result.virtualHost = 'KVM'; }
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (result.manufacturer.toLowerCase().startsWith('vmware') || result.manufacturer.toLowerCase() === 'xen') {
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: result.virtualHost = 'VMware';
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: result.virtualHost = 'QEMU';
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: result.virtualHost = 'VMware';
Source: ShadowFury.exe, 00000000.00000003.1892978701.0000000006970000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: IIAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTest
Source: ShadowFury.exe, 00000000.00000003.1884195439.0000000006830000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (str.indexOf('vmware') >= 0) { result = 'VMware'; }
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: case 'vmware':
Source: ShadowFury.exe, 00000000.00000003.1884452784.0000000006C30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: if (disksById.indexOf('_QEMU_') >= 0) {
Source: ShadowFury.exe, 00000000.00000003.1987405093.0000000005025000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware Screen Codec / VMware Video
Source: C:\Users\user\Desktop\ShadowFury.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\ShadowFury" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 --field-trial-handle=1976,i,5983286272222929098,2111862597278059386,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\ShadowFury" --mojo-platform-channel-handle=2136 --field-trial-handle=1976,i,5983286272222929098,2111862597278059386,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log"" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\ShadowFury" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1976,i,5983286272222929098,2111862597278059386,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\ShadowFury" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 --field-trial-handle=1972,i,18180359127166526210,17872614602038801051,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\ShadowFury" --mojo-platform-channel-handle=2164 --field-trial-handle=1972,i,18180359127166526210,17872614602038801051,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log"" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "c:\users\user\appdata\local\programs\shadowfury\shadowfury.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\shadowfury" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1972 --field-trial-handle=1976,i,5983286272222929098,2111862597278059386,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "c:\users\user\appdata\local\programs\shadowfury\shadowfury.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\shadowfury" --mojo-platform-channel-handle=2136 --field-trial-handle=1976,i,5983286272222929098,2111862597278059386,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "c:\users\user\appdata\local\programs\shadowfury\shadowfury.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\shadowfury" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1968 --field-trial-handle=1972,i,18180359127166526210,17872614602038801051,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "c:\users\user\appdata\local\programs\shadowfury\shadowfury.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\shadowfury" --mojo-platform-channel-handle=2164 --field-trial-handle=1972,i,18180359127166526210,17872614602038801051,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "c:\users\user\appdata\local\programs\shadowfury\shadowfury.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\shadowfury" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1808 --field-trial-handle=1976,i,5983286272222929098,2111862597278059386,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "c:\users\user\appdata\local\programs\shadowfury\shadowfury.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\shadowfury" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1444 --field-trial-handle=1972,i,18180359127166526210,17872614602038801051,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "c:\users\user\appdata\local\programs\shadowfury\shadowfury.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\shadowfury" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1972 --field-trial-handle=1976,i,5983286272222929098,2111862597278059386,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "c:\users\user\appdata\local\programs\shadowfury\shadowfury.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\shadowfury" --mojo-platform-channel-handle=2136 --field-trial-handle=1976,i,5983286272222929098,2111862597278059386,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "c:\users\user\appdata\local\programs\shadowfury\shadowfury.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\shadowfury" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1808 --field-trial-handle=1976,i,5983286272222929098,2111862597278059386,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "c:\users\user\appdata\local\programs\shadowfury\shadowfury.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\shadowfury" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1968 --field-trial-handle=1972,i,18180359127166526210,17872614602038801051,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Process created: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe "c:\users\user\appdata\local\programs\shadowfury\shadowfury.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\shadowfury" --mojo-platform-channel-handle=2164 --field-trial-handle=1972,i,18180359127166526210,17872614602038801051,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8 Jump to behavior
Source: ShadowFury.exe, 00000000.00000003.1983268209.0000000007537000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: ..\..\third_party\webrtc\modules\desktop_capture\win\window_capture_utils.ccFail to create instance of VirtualDesktopManagerChrome_WidgetWin_ProgmanWindowsDeleteStringWindowsCreateString
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Users\user\AppData\Local VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Users\user\AppData\Local\Programs\ShadowFury VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Users\user\AppData\Local\Programs\ShadowFury\resources VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Users\user\AppData\Local\Programs\ShadowFury\resources\app.asar VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Windows\SysWOW64\cmd.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Users\user\AppData\Local VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Users\user\AppData\Local\Programs\ShadowFury VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Windows\SysWOW64\cmd.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Tries to steal communication platform credentials (via file / registry access)
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe file Attributes Queried: C:\Users\user\AppData\Local\Discord Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe file Attributes Queried: C:\Users\user\AppData\Local\DiscordCanary Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe file Attributes Queried: C:\Users\user\AppData\Local\DiscordPTB Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe file Attributes Queried: C:\Users\user\AppData\Local\Discord Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe file Attributes Queried: C:\Users\user\AppData\Local\DiscordCanary Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\ShadowFury\ShadowFury.exe file Attributes Queried: C:\Users\user\AppData\Local\DiscordPTB Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1430162 Sample: ShadowFury.exe Startdate: 23/04/2024 Architecture: WINDOWS Score: 68 69 ipinfo.io 2->69 71 illitluckygirl.com 2->71 79 Snort IDS alert for network traffic 2->79 81 Multi AV Scanner detection for domain / URL 2->81 8 ShadowFury.exe 5 2->8         started        13 ShadowFury.exe 5 2->13         started        15 ShadowFury.exe 12 194 2->15         started        signatures3 process4 dnsIp5 75 ipinfo.io 34.117.186.192, 443, 49741, 49744 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 8->75 53 6f9c7dcb-c5ec-4d75...e1fcff8c95.tmp.node, PE32 8->53 dropped 55 65009a31-e18f-4331...74113ace84.tmp.node, PE32 8->55 dropped 83 Tries to steal communication platform credentials (via file / registry access) 8->83 85 Opens the same file many times (likely Sandbox evasion) 8->85 17 powershell.exe 21 8->17         started        20 powershell.exe 8->20         started        22 ShadowFury.exe 1 8->22         started        31 6 other processes 8->31 57 ece2b052-aa6a-477b...0581807657.tmp.node, PE32 13->57 dropped 59 c72e6d37-050a-4632...b85d93d972.tmp.node, PE32 13->59 dropped 25 powershell.exe 13->25         started        27 powershell.exe 13->27         started        29 cmd.exe 13->29         started        33 6 other processes 13->33 61 C:\Users\user\AppData\...\ShadowFury.exe, PE32 15->61 dropped 63 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 15->63 dropped 65 C:\Users\user\AppData\Local\...\System.dll, PE32 15->65 dropped 67 16 other files (none is malicious) 15->67 dropped file6 signatures7 process8 dnsIp9 77 Loading BitLocker PowerShell Module 17->77 35 conhost.exe 17->35         started        37 conhost.exe 20->37         started        73 chrome.cloudflare-dns.com 162.159.61.3, 443, 49742, 49743 CLOUDFLARENETUS United States 22->73 39 conhost.exe 25->39         started        41 conhost.exe 27->41         started        47 2 other processes 29->47 43 conhost.exe 31->43         started        45 conhost.exe 31->45         started        49 4 other processes 31->49 51 4 other processes 33->51 signatures10 process11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
34.117.186.192
 ipinfo.io United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
162.159.61.3
 chrome.cloudflare-dns.com United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
chrome.cloudflare-dns.com 162.159.61.3 true
ipinfo.io 34.117.186.192 true
illitluckygirl.com unknown unknown