egregor | ad5d3ab1ddde2346e12cf4d50db6f1aa75cb12db0ee3ce744057a1aa2ac9e67e

Analysis

max time kernel
272s
max time network
263s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

entry_1_0/umbrella-installer-for-talkia.exe
Size

99.5MB
MD5

412dfcd64a4f0948f7fcc920326ebb6e
SHA1

03446d3be14e3173c486bdce97098a7040b1d3fe
SHA256

174b5a8fdbc649eadcb98e99c5dd144a2f763cc2edbee02c1904c1c6ee5d5d1b
SHA512

05414e1c8304444f7c1a5794e2ea639e84676b77a00b2ad636e3172589d014fcc3eb858f3004615a7efd36ebd9b93a23dec312998263dccebb2b8d340960f287
SSDEEP

3145728:QlXHtKf7dHNL0qPulXZyAKcBIhSk5gE2NxmMf2:mt87TYlXKcBlksxa

Score

10^/10

egregor ransomware

Malware Config

Signatures

Detected Egregor ransomware 1 IoCs

resource	yara_rule
behavioral1/files/0x0004000000019da5-839.dat	family_egregor

Egregor Ransomware
Variant of the Sekhmet ransomware first seen in September 2020.
ransomware egregor

Blocklisted process makes network request 10 IoCs

flow	pid	Process
16	2700	cmd.exe
19	2700	cmd.exe
20	2700	cmd.exe
25	2700	cmd.exe
26	2700	cmd.exe
27	2700	cmd.exe
30	2700	cmd.exe
31	2700	cmd.exe
32	2700	cmd.exe
35	2700	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
2016	Talkia.exe
1056	Talkia.exe
1700	Talkia.exe
1892	chcp.com
2040	conhost.exe
2700	cmd.exe
2432	Talkia.exe
1268	cmd.exe
1472	Talkia.exe
2664	conhost.exe
2564	cmd.exe
1712	Talkia.exe

Loads dropped DLL 50 IoCs

pid	Process
2280	umbrella-installer-for-talkia.exe
2280	umbrella-installer-for-talkia.exe
2280	umbrella-installer-for-talkia.exe
2280	umbrella-installer-for-talkia.exe
2280	umbrella-installer-for-talkia.exe
2280	reg.exe
2280	reg.exe
2280	reg.exe
2280	reg.exe
2280	reg.exe
2280	reg.exe
1400	Process not Found
2016	Talkia.exe
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1056	Talkia.exe
1700	Talkia.exe
2700	cmd.exe
1892	chcp.com
2040	conhost.exe
1892	chcp.com
1892	chcp.com
1892	chcp.com
2040	conhost.exe
2040	conhost.exe
2040	conhost.exe
2432	Talkia.exe
1268	cmd.exe
1472	Talkia.exe
1472	Talkia.exe
1472	Talkia.exe
1472	Talkia.exe
1472	Talkia.exe
1472	Talkia.exe
1472	Talkia.exe
1472	Talkia.exe
1472	Talkia.exe
2664	conhost.exe
2664	conhost.exe
2664	conhost.exe
2664	conhost.exe
2664	conhost.exe
2664	conhost.exe
2664	conhost.exe
2664	conhost.exe
2664	conhost.exe
2564	cmd.exe
1712	Talkia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2616	tasklist.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	Talkia.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Talkia.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Talkia.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Talkia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	Talkia.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	Talkia.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2280	umbrella-installer-for-talkia.exe
2616	tasklist.exe
2616	tasklist.exe
2564	cmd.exe
1056	Talkia.exe
1056	Talkia.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	tasklist.exe
Token: SeSecurityPrivilege	2280	umbrella-installer-for-talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	2016	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe
Token: SeShutdownPrivilege	1056	Talkia.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2184	2280	umbrella-installer-for-talkia.exe	28
PID 2280 wrote to memory of 2184	2280	umbrella-installer-for-talkia.exe	28
PID 2280 wrote to memory of 2184	2280	umbrella-installer-for-talkia.exe	28
PID 2280 wrote to memory of 2184	2280	umbrella-installer-for-talkia.exe	28
PID 2184 wrote to memory of 2616	2184	cmd.exe	30
PID 2184 wrote to memory of 2616	2184	cmd.exe	30
PID 2184 wrote to memory of 2616	2184	cmd.exe	30
PID 2184 wrote to memory of 2616	2184	cmd.exe	30
PID 2184 wrote to memory of 2512	2184	cmd.exe	31
PID 2184 wrote to memory of 2512	2184	cmd.exe	31
PID 2184 wrote to memory of 2512	2184	cmd.exe	31
PID 2184 wrote to memory of 2512	2184	cmd.exe	31
PID 2016 wrote to memory of 3060	2016	Talkia.exe	37
PID 2016 wrote to memory of 3060	2016	Talkia.exe	37
PID 2016 wrote to memory of 3060	2016	Talkia.exe	37
PID 3060 wrote to memory of 1128	3060	cmd.exe	39
PID 3060 wrote to memory of 1128	3060	cmd.exe	39
PID 3060 wrote to memory of 1128	3060	cmd.exe	39
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 1056 wrote to memory of 2144	1056	Talkia.exe	42
PID 1056 wrote to memory of 2144	1056	Talkia.exe	42
PID 1056 wrote to memory of 2144	1056	Talkia.exe	42
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2016 wrote to memory of 2040	2016	Talkia.exe	677
PID 2144 wrote to memory of 3008	2144	cmd.exe	44
PID 2144 wrote to memory of 3008	2144	cmd.exe	44
PID 2144 wrote to memory of 3008	2144	cmd.exe	44
PID 1056 wrote to memory of 1892	1056	Talkia.exe	831
PID 1056 wrote to memory of 1892	1056	Talkia.exe	831
PID 1056 wrote to memory of 1892	1056	Talkia.exe	831
PID 1056 wrote to memory of 1892	1056	Talkia.exe	831
PID 1056 wrote to memory of 1892	1056	Talkia.exe	831
PID 1056 wrote to memory of 1892	1056	Talkia.exe	831
PID 1056 wrote to memory of 1892	1056	Talkia.exe	831
PID 1056 wrote to memory of 1892	1056	Talkia.exe	831
PID 1056 wrote to memory of 1892	1056	Talkia.exe	831
PID 1056 wrote to memory of 1892	1056	Talkia.exe	831
PID 1056 wrote to memory of 1892	1056	Talkia.exe	831
PID 1056 wrote to memory of 1892	1056	Talkia.exe	831
PID 1056 wrote to memory of 1892	1056	Talkia.exe	831
PID 1056 wrote to memory of 1892	1056	Talkia.exe	831
PID 1056 wrote to memory of 1892	1056	Talkia.exe	831
PID 1056 wrote to memory of 1892	1056	Talkia.exe	831

C:\Users\Admin\AppData\Local\Temp\entry_1_0\umbrella-installer-for-talkia.exe
"C:\Users\Admin\AppData\Local\Temp\entry_1_0\umbrella-installer-for-talkia.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Talkia.exe" | %SYSTEMROOT%\System32\find.exe "Talkia.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Talkia.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- - C:\Windows\SysWOW64\find.exe
    C:\Windows\System32\find.exe "Talkia.exe"
    3⤵
    PID:2512

C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe
"C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:1128
- C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe
  "C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\talkia" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1076 --field-trial-handle=1152,i,17309789378632198287,16243064820372414699,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:2040
- C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe
  "C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\talkia" --mojo-platform-channel-handle=1272 --field-trial-handle=1152,i,17309789378632198287,16243064820372414699,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:2700
- C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe
  "C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\talkia" --app-path="C:\Users\Admin\AppData\Local\Programs\talkia\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1408 --field-trial-handle=1152,i,17309789378632198287,16243064820372414699,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  PID:1268
- C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe
  "C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\talkia" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1584 --field-trial-handle=1152,i,17309789378632198287,16243064820372414699,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:2664
- C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe
  C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe C:\Users\Admin\AppData\Local\Programs\talkia\resources\app.asar\node_modules\@voomly_llc\electron-apps-updater\dist\systemInfoProcess-867e9cda.js
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2560
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2592
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2064
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2844
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2972
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1552
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1516
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:580
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:3040
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1592
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1556
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2920
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1556
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2120
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2040
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2712
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2912
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2940
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
      4⤵
      PID:1696
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:2980
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2092
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1200
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2368
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2968
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:796
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2128
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:3036
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2264
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2980
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:792
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1820
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2064
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2944
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2124
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1552
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:3064
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:920
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2388
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2848
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2092

C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe
"C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:3008
- C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe
  "C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\talkia" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=956 --field-trial-handle=1112,i,5683090894085006004,1960303964370640524,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:1892
- C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe
  "C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\talkia" --app-path="C:\Users\Admin\AppData\Local\Programs\talkia\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1376 --field-trial-handle=1112,i,5683090894085006004,1960303964370640524,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2432
- C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe
  "C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\talkia" --mojo-platform-channel-handle=1272 --field-trial-handle=1112,i,5683090894085006004,1960303964370640524,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1700
- C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe
  "C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\talkia" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=956 --field-trial-handle=1112,i,5683090894085006004,1960303964370640524,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1472
- C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe
  C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe C:\Users\Admin\AppData\Local\Programs\talkia\resources\app.asar\node_modules\@voomly_llc\electron-apps-updater\dist\systemInfoProcess-867e9cda.js
  2⤵
  PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "chcp"
    3⤵
    PID:2088
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:2980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1524
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2444
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1100
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1796
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2980
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:928
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1076
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2052
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2752
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2408
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1064
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:772
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1548
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1740
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2324
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
      4⤵
      PID:1456
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:1592
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
        5⤵
        
        PID:1308
    - - C:\Windows\system32\chcp.com
        
        C:\Windows\system32\chcp.com 65001
        5⤵
        
        PID:812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2328
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1176
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2120
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1696
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:796
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2088
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1888
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1740
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1808
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2216
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:3040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2400
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:580
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1736
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
      4⤵
      PID:2104
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2080
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1632
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1100
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1796
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2084
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1548
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1176
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1724
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1808
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1556
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1820
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1324
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2980
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2852
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2348
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2204
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2388
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2120
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2028
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:3056
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2412
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2684
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:304
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2508
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2472
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2364
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2524
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1096
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:3024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2360
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2416
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:3048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1060
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2888
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1668
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2308
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1108
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1076
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2104
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:524
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:1900
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:796
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1900
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:2448
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:2400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2884
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1988
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
      4⤵
      PID:2096
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:2736
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:884
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2176
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2224
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2080
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2640
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:3036
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:888
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2132
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2052
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:936
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2320
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2216
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1584
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:640
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2960
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1684
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1004
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2944
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1520
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1524
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2976
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2204
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2236
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2388
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:2968
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:2788
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2040
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1200
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2476
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1752
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2424
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1908
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2256
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2688
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:304
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1348
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:368
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2368
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2416
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2088
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2888
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1668
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2768
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:3016
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2400
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:580
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:1916
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:1268
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1392
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2100
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2620
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2260
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
      4⤵
      PID:1392
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:2676
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2660
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1796
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2640
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2132
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:2084
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:1576
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1812
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2084
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1176
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2784
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:2844
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
        5⤵
        
        PID:3040
      - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
        6⤵
        
        PID:1960
      - C:\Windows\system32\chcp.com
        
        C:\Windows\system32\chcp.com 65001
        6⤵
        
        PID:1340
    - - C:\Windows\system32\chcp.com
        
        C:\Windows\system32\chcp.com 65001
        5⤵
        
        PID:2328
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:2880
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2920
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2328
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:3040
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
      4⤵
      PID:1776
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:2328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2960
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2584
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1004
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1520
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:2444
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:2456
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2092
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:344
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2204
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2872
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2976
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2480
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1044
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2028
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:3056
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1908
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:660
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2508
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2764
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
      4⤵
      PID:304
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1728
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2496
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2644
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2312
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
      4⤵
      PID:768
  - - C:\Windows\system32\chcp.com
      C:\Windows\system32\chcp.com 65001
      4⤵
      PID:2196
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1060
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1864
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1616
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2904
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1188
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2164
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:3040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:344
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1692
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1920
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1616
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:640
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2068
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:888
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1176
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2344
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1200
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1440
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2388
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:3048
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:604
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1708
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2928
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2416
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2308
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1736
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1668
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2676
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2096
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1988
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    - Loads dropped DLL
    PID:2280
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2624
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2080
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1796
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1576
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2640
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2588
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2320
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1776
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2844
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2064
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2784
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2044
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1520
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1256
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2632
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2396
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:756
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2380
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:3064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2976
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1908
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2788
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1080
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  - Blocklisted process makes network request
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1016
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2524
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:3024
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1896
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2360
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1356
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2196
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:368
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1616
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2888
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2100
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2600
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:812
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2624
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2084
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1188
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2844
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2044
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:3040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2444
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1552
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1520
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2632
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2504
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2380
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2212
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2232
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:816
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2024
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1080
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2500
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1272
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1348
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1920
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1204
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1668
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:796
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:524
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2448
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1392
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2172
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2288
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:616
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2080
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1064
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:936
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2164
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1584
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2492
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2384
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2988
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1732
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2844
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2784
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1996
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2564
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1892
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:792
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2060
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2480
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:3064
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2692
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2792
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2476
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2012
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2024
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2544
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1080
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2524
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1348
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1356
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1020
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:516
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:3016
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:760
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1268
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2400
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1800
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2956
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2488
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2264
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2908
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2600
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1580
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2624
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2324
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1576
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:640
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2220
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2320
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2316
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2136
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2064
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:3044
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1732
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2368
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2348
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2784
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2444
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2632
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2972
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2092
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2380
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2028
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2040
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2356
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2240
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2568
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2684
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2788
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2424
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1272
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2196
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:3024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1348
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1896
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:276
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1928
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2728
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2776
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2104
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2072
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2704
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2932
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2260
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1916
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2604
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2172
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2516
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1456
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1592
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2408
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1296
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2324
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1984
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1596
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1548
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1812
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:3040
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2136
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2464
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:3044
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2348
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2332
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2444
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2060
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:792
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2720
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2092
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1652
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2812
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2476
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1752
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:660
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2568
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1956
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:3048
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2196
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:3024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2088
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1708
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2964
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2780
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2108
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1616
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2888
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:3016
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1948
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2008
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:580
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2956
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1916
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2148
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1628
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:616
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2288
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1152
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2248
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1796
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2648
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:688
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:936
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2216
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1188
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2864
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2292
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:3040
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1184
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2464
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1820
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1996
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2696
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2972
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2900
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1200
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2632
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:3056
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1352
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2240
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2812
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2256
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2508
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1080
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:584
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2188
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:740
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2836
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:1348
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2780
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1864
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2128
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:1116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2884
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1992
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:1668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1604
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:884
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:2200
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:1284
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:1664
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:2936
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:2488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName"
  2⤵
  PID:616
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
    3⤵
    PID:2624
- - C:\Windows\system32\chcp.com
    C:\Windows\system32\chcp.com 65001
    3⤵
    PID:3036

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:2752

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
1⤵
PID:1724

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
1⤵
PID:2232

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:1340

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:2096

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:1176

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:1632

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:560

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
1⤵
PID:1536

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:2936

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:1740

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:2096

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
1⤵
PID:1576

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:1796

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
1⤵
PID:2232

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:2376

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
1⤵
PID:1692

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:2480

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
1⤵
PID:2844

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:2064

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:2936

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
1⤵
PID:888

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:2320

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:2736

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:2812
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
  2⤵
  PID:2428
- C:\Windows\system32\chcp.com
  C:\Windows\system32\chcp.com 65001
  2⤵
  PID:1512

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:2012

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "159088246319379718374801502092039559698-37951654113833804969093771721612490949"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-81039152221120409-4658954341770985286-54239562-1269947004519114467-1410185282"
1⤵
PID:1556

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "10596799631027878117-6848623021960194539133151842-1628524597-475443934499828589"
1⤵
PID:2536

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "12943234936367086561224623225254148302-1434010910-1716418163746862128-2093634023"
1⤵
PID:2996

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1807980058200180505856573794-1459088749-15244449681270622440-1614340764-85109879"
1⤵
PID:2688

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:2196

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
1⤵
PID:1204

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:1920

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-125691152614936362521462655978-1178308019-1205723721-2065284428-1011839400531874360"
1⤵
PID:884

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:1324

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-81355088-11347158401161194773-1244196525-47523326318001217151254294204-444555500"
1⤵
PID:2364

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:2700
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
  2⤵
  PID:584
- C:\Windows\system32\chcp.com
  C:\Windows\system32\chcp.com 65001
  2⤵
  PID:2684

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:2280

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
1⤵
PID:2592

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:2944

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
1⤵
PID:2608

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:1552
- C:\Windows\system32\chcp.com
  C:\Windows\system32\chcp.com 65001
  2⤵
  PID:2376

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1850503917-1609650081-4750507812068828628-897817794-11947388778275657561959700263"
1⤵
PID:2960

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:2936
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
  2⤵
  PID:1740
- C:\Windows\system32\chcp.com
  C:\Windows\system32\chcp.com 65001
  2⤵
  PID:1100

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:2256

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-112921977516065199841497379487-1427035734497410024134791785113915043281069610337"
1⤵
PID:2868

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:952

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:2416

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
1⤵
PID:2500

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:2508

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1075130732722118124-682524935-2105842321589275170-9099970001448776301758654851"
1⤵
PID:1864

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:368

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:2108
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
  2⤵
  PID:2780
- C:\Windows\system32\chcp.com
  C:\Windows\system32\chcp.com 65001
  2⤵
  PID:2964

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
1⤵
PID:868

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:2548

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "210686141118123411601241244627-1796385707-4390953861098994134-186746927-1890650309"
1⤵
PID:1632

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "933807720-1132366272-918648822-1251206803-1154341842-12800706877151529791276783203"
1⤵
PID:2560

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-38652795-9493908591149800347111975070249815416-1458902512274113443-896323833"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1519153620-91727371510738541-45226027-12926944811318750010-836738789-1907172007"
1⤵
PID:604

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "578608615-249329730739067529-4292124151509832991-49070373-10880826111923708776"
1⤵
PID:2496

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:2964

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:1920

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "79451867-182641057122136058554846447568372465614405695661591641447463945233"
1⤵
PID:1116

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
1⤵
PID:1604

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:1012

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:2096

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:2148

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
1⤵
PID:1796

C:\Windows\system32\chcp.com
C:\Windows\system32\chcp.com 65001
1⤵
PID:1576
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2174d5d6-2661-5906-b03b-91a0fed458c1" /v DisplayName
  2⤵
  PID:2588
- C:\Windows\system32\chcp.com
  C:\Windows\system32\chcp.com 65001
  2⤵
  PID:1296

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "3580641091942435672342601205-1560730531142096258-1301394229-977284396-1801376779"
1⤵
PID:1984

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "5149303421196930896145008023-1691784530-1485758801917636230730645993-1630023681"
1⤵
PID:1688

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-13012711375368719491580766576-1705058699-713107943-106191432913940693662068603505"
1⤵
PID:3048

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-559610584-1553691681-1977116935-1482024709-7586651281455948063265773051509300981"
1⤵
PID:2416

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "7003572791382613157-255361610-1660163613-3369413751234076627-291882017273790069"
1⤵
PID:1736

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "208921979017321594962184475832689445271803164704620673282-186373189-2097845529"
1⤵
PID:1308

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1320746952-744141651-8030922041965945634-18802823272943271141386626943-674520526"
1⤵
PID:2224

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-173791852-652016181-2081945197-1025070578-861870524-829901291798432421732425315"
1⤵
PID:1188

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "8758080471405263341171149347-208268016810131182681567108851-273288905-1034740353"
1⤵
PID:908

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1976659034-1195895265-1354459191-578923780-17034214941602684784-200672031077507150"
1⤵
PID:344

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "172366148813265634245060469141631493079-913329794-5317198551003278110284592130"
1⤵
PID:2504

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1584580692537299646-329970181-1278477136-481753544729363504-17144901921896020324"
1⤵
PID:2508

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1084211226-1590152386197763561-14555089471843340541208406039-706387031161500950"
1⤵
PID:2472

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1873260108-1397184211624283632820216812102301067-1885433856-542496658727106216"
1⤵
PID:2128

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-653092346689932885-205809977324178997153530947735358681-8434254681463119647"
1⤵
PID:2008

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1800827501500158355-542595746-14126396481191499588869156274374411309-674193989"
1⤵
PID:2448

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-290693446458197191-6965068781629353651982754882-1957866514-778211133-1913052299"
1⤵
PID:2936

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1080346052-1404301844-600325575966953654-295547421-19527034041256003969-1596132039"
1⤵
PID:1456

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2048426554-1410345309-895466244-3427901311958942353447670419-17752267561682053130"
1⤵
PID:812

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "440098549-834658033-1443981486-1718711869151814311483443620-61882244-876004889"
1⤵
PID:1724

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-887174172127661269458535167881079276086424872918733374591331464472-438761853"
1⤵
PID:1812

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2059118761998186605481561825461169851713116088-1978424886-2893078572023342463"
1⤵
PID:2940

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "789961614-1016482534-10601357721768403511578800099263886433285679701-813946048"
1⤵
PID:2584

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "21297656781449776991-673130201-10307178741736276789-12246301282129005986-1247636102"
1⤵
PID:2608

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-535265489795655480134342170217746895912103128809-96036072-1793093934-1751733808"
1⤵
PID:1524

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1866376305-119069233-1888642055-2040143987-2096478075-147905949119283569451376672302"
1⤵
PID:2204

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-806301872-14531519701618955102-1322297147-795942675544576603-1246030674-804011155"
1⤵
PID:2976

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "932183938509131224-1458549247-4677377062114094327208746121516450086831618596098"
1⤵
PID:2012

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1989187525327923060-1261738814-1311712845-40576530614864152601114633743-1020596029"
1⤵
PID:660

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2608257908807988901536865361-20281722-629983328-1761186686245160062228803650"
1⤵
PID:304

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1304500315-321410320370199544760699522-1650159231901949440-21048587461462816182"
1⤵
PID:768

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "20662298371015754011-4922240751383407081160458469866464126-214312546344148855"
1⤵
PID:760

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "8682323171813197927-1016926113761503433-1680458638100016738118021634001015970922"
1⤵
PID:1076

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "13191244211043732534-1972019666-82174985-3814248566804557561084220784-1312540842"
1⤵
PID:2548

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-772262160169582976-1144958400622737024-1330142021-1613391714467746483-1583352536"
1⤵
PID:2676

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "825246828-15711035201133176481-1245617002-2041113324-927629609-276981885913010744"
1⤵
PID:2280

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-16003872451984983461-1886767089-56647076315908980862378921579087089231042283348"
1⤵
PID:1576

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1681301621-1781522531660000011190761569-1121833894-1758744257-6499149041615778898"
1⤵
PID:2164

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "100636421218239704891945925826-822645549-1104774967-751440610-1176870383664059762"
1⤵
PID:1584

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "713968308-1874725374-54880236560221339214848632161518137832-798472918-1350189793"
1⤵
PID:1784

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1621353696-58888324863698191710630664151137671977-2005221109560259207146407415"
1⤵
PID:2456

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1727941004-114898926954453893632656106-1828475411-42531679-795299271-440311118"
1⤵
PID:1996

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2000737184-437590268-19723096331373234309196731101418604085821959347417-1598095388"
1⤵
PID:756

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-182612782490853436578880201-1858514825-1826021943-2081435604-1405711967716377818"
1⤵
PID:2976

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1076736445-1194732324-1094430979-8652272179611175431176341487-251029141-983278554"
1⤵
PID:2024

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1084038740-981886070205347615653006140-433763359-465964227-12029473121585690691"
1⤵
PID:368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e56ec378251cd65923ad88c1e14d0b6e

SHA1
7f5d986e0a34dd81487f6439fb0446ffa52a712e

SHA256
32ccf567c07b62b6078cf03d097e21cbf7ef67a4ce312c9c34a47f865b3ad0a0

SHA512
2737a622ca45b532aebc202184b3e35cde8684e5296cb1f008e7831921be2895a43f952c1df88d33011a7b9586aafbd88483f6c134cb5e8e98c236f5abb5f3aa

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\D3DCompiler_47.dll

Filesize
4.7MB

MD5
cb9807f6cf55ad799e920b7e0f97df99

SHA1
bb76012ded5acd103adad49436612d073d159b29

SHA256
5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

SHA512
f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\chrome_100_percent.pak

Filesize
126KB

MD5
a3d4515d3a33a407d313a62818e82a5d

SHA1
967ff9a6774a66f7b3299af4fd5d70961ed54d79

SHA256
662a9db6ef4197cb4b6c50648a2cafceb7fd903015828df3fee605a602370be0

SHA512
0c757e1beccbca1ae0791fa0c51a9e2019696bd0965c73de67b364fba6f317ea2cf20fa65e4fa7dd22519683528e5112dc8c530049170f4e702e0c8d4e065801

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\chrome_200_percent.pak

Filesize
175KB

MD5
3bab45c70f22646cf8452c30903810cb

SHA1
40b31d4c79b5a2b8d12f8cf8b6c49c962c31f766

SHA256
d4282ae977f23afe252e19e421c8d09696ea3b83a1e73a6aaebaaa5547c74cbc

SHA512
85eda055494f0233c963e821906cf69d94e664d8396e8b08e7a8f412e1c16af71252fef1bfe3ed43cfad157aa90c0dcbb375626e2ddf0e807c9b23ad27e61d9c

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\ffmpeg.dll

Filesize
2.7MB

MD5
43c251b59c979399d6e9f5b643e5f2eb

SHA1
7f9ce5f18ea429bdf4088382efcd3ac1669e0326

SHA256
8cf2aea3a368a6bc90f1a2b07acf1518a42224d99836c0580db2a6031a3c8d40

SHA512
c77caf67c53d1b49ce0feeae1edad7b859144d3c78ae10a34073e424ac6e43c48f3e33e835162a6164d8c8ca036adbb0b3ff7929dd40e72819bbb18f176edc55

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\icudtl.dat

Filesize
10.0MB

MD5
516f6b90d1539bd1eaeaa2fc32dadb92

SHA1
8017789bef98902cdc95c18e67b84378ddd293c0

SHA256
51edd31f6c5d298c662af320424b632172a31e3348cdbb201380636c95ded794

SHA512
db4b5fd7f8a0e0a331ffa7c574d011b059df8654cdc6ee4970f84fda20b88a3b8706f2605d91d19a6dd86d2702cc9542e026a054d28f85c51b676daa8d3f3bb0

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\libegl.dll

Filesize
458KB

MD5
a2f50aa2de05f7765208db45c0fac2a6

SHA1
a358dbbaae33f23ca6877f9902fc71b3aacfd8de

SHA256
c1ec4d974dcc8638287e028d01d56213e47eb0632742ea696c6ca518a750bf04

SHA512
223e8f34f07792ab1691bb7cedb29137a85c8cd7c07ad5d6d6131ad042e98d843117c56cb1e0c3165201f29650fe6f96ed72946b9db57b1d2986a525aca3e778

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\libglesv2.dll

Filesize
7.1MB

MD5
6c7d96f2c9b611e1a6d4a234360f4652

SHA1
f1a1e7ff9d20184316c5bf4386918b3149b01c59

SHA256
7d2a9cfa2ba7dfd17a4be7d573b66ce19ca5ee7e55ed737db60ecfc4d2413ca5

SHA512
99850f64f41c2accbdc0c1e6ebbf987842f51a5bcc4b600a5a351f7fb7be13bb12381c33bf9f0c095ad59c0f0a8f1cc21f63bd45e535e69015a97b777c2e2661

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\locales\en-US.pak

Filesize
295KB

MD5
a2ed0e17819c287b824cae5c0ac03af7

SHA1
9694627f89cd65fbb511eacc6c785ab045525ff2

SHA256
c4a2c6a90945868a02ad14b3a994e94b123981d56190bd34cc3cb14f31f2270b

SHA512
a527351a1c61e6ed4e999c6549ec04b2096712644c4e1f28b48872c031c9f0a4bb118c0ceb40dc3a35315ddc7cf244e3c0c03d864a53d4a76f6dcf1b3889c109

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\resources.pak

Filesize
5.1MB

MD5
dacace0ad6d390d392b7dbccc92323bf

SHA1
0cb6780041464d9250cac0a8cf9809bd8c1a8338

SHA256
b428b9d91626ce69d0a4fafbc7f0062ad46137677da53bd649dfa8e8d01ffb69

SHA512
84ad6328c9ccd54dec116b0c729ae14134a106c3b2b63faa967b94cc8a5751ac4f6e5d0fbb4cd7a39096a89cb8f0889ddaf2fef07c852a6dde8bacd790c818e5

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\resources\app.asar

Filesize
181.3MB

MD5
1d3a991def3e8cc7f1057f44ffe286b5

SHA1
0114a534beaec72fd6aeb75d853bd18c3aa0da58

SHA256
4a067de96778741672ecc7b1fa3c804fcb3619ce7aecdafbc1d444fb7464e400

SHA512
741e2283a3423507fef7a3d59e13070575bffe0937bfb09a2f3132343fcd3c9165215e1166c2a1e823cef0c9ef4eaa1b8997059b9ccd071be36a89b398fcf43f

Download Submit
C:\Users\Admin\AppData\Local\Programs\talkia\v8_context_snapshot.bin

Filesize
716KB

MD5
25727ffbdf9cc388e7cce38bbfbdb62a

SHA1
4dc875473b0916ecc602e6e0fc851e460f574be9

SHA256
83031cb1ea99bd520eeb4e29683077163ed4359769d84bb78d373475fb95b1cc

SHA512
439c1dfa8e98a0c9eb62269e4722fa8ebef06fe98149fcd95c5f0f516c07d82caa4975ea1dfe3ab1cf011ee5d29d2f67640f36bdc9cb5eee2cf16d50d4260bc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB654.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBC33.tmp

Filesize
163KB

MD5
19399ab248018076e27957e772bcfbab

SHA1
faef897e02d9501146beb49f75da1caf12967b88

SHA256
326842dd8731e37c8c27a08373c7ac341e6c72226cc850084e3a17d26675f3c9

SHA512
6d5b12ec637ef4223fdd0e271cdc9f860b060ff08d380bba546ac6962b1d672003f9ae9556d65282d8083e830d4277bad8d16443720716077e542ab0262b0103

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\LICENSES.chromium.html

Filesize
6.3MB

MD5
997768ae7eb8c036425bed10f766e823

SHA1
2ec99026b977f6603a8a7890bc05594a9a4f13a1

SHA256
ab30ee348b3257ec2f19fb5733e64278438be792f1280ce0f28eae0c9cb8943c

SHA512
f408b817b68861cbad62425e0bb8726f876d36a2212186a8f948d5c825c95ed819dcc41284d8ad8ac11e7ab7ff6141588fededd01c287780f84269846515f639

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\chrome_100_percent.pak

Filesize
126KB

MD5
a3d4515d3a33a407d313a62818e82a5d

SHA1
967ff9a6774a66f7b3299af4fd5d70961ed54d79

SHA256
662a9db6ef4197cb4b6c50648a2cafceb7fd903015828df3fee605a602370be0

SHA512
0c757e1beccbca1ae0791fa0c51a9e2019696bd0965c73de67b364fba6f317ea2cf20fa65e4fa7dd22519683528e5112dc8c530049170f4e702e0c8d4e065801

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\chrome_200_percent.pak

Filesize
175KB

MD5
3bab45c70f22646cf8452c30903810cb

SHA1
40b31d4c79b5a2b8d12f8cf8b6c49c962c31f766

SHA256
d4282ae977f23afe252e19e421c8d09696ea3b83a1e73a6aaebaaa5547c74cbc

SHA512
85eda055494f0233c963e821906cf69d94e664d8396e8b08e7a8f412e1c16af71252fef1bfe3ed43cfad157aa90c0dcbb375626e2ddf0e807c9b23ad27e61d9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.7MB

MD5
cb9807f6cf55ad799e920b7e0f97df99

SHA1
bb76012ded5acd103adad49436612d073d159b29

SHA256
5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

SHA512
f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\ffmpeg.dll

Filesize
2.7MB

MD5
43c251b59c979399d6e9f5b643e5f2eb

SHA1
7f9ce5f18ea429bdf4088382efcd3ac1669e0326

SHA256
8cf2aea3a368a6bc90f1a2b07acf1518a42224d99836c0580db2a6031a3c8d40

SHA512
c77caf67c53d1b49ce0feeae1edad7b859144d3c78ae10a34073e424ac6e43c48f3e33e835162a6164d8c8ca036adbb0b3ff7929dd40e72819bbb18f176edc55

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\icudtl.dat

Filesize
10.0MB

MD5
516f6b90d1539bd1eaeaa2fc32dadb92

SHA1
8017789bef98902cdc95c18e67b84378ddd293c0

SHA256
51edd31f6c5d298c662af320424b632172a31e3348cdbb201380636c95ded794

SHA512
db4b5fd7f8a0e0a331ffa7c574d011b059df8654cdc6ee4970f84fda20b88a3b8706f2605d91d19a6dd86d2702cc9542e026a054d28f85c51b676daa8d3f3bb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\libEGL.dll

Filesize
458KB

MD5
a2f50aa2de05f7765208db45c0fac2a6

SHA1
a358dbbaae33f23ca6877f9902fc71b3aacfd8de

SHA256
c1ec4d974dcc8638287e028d01d56213e47eb0632742ea696c6ca518a750bf04

SHA512
223e8f34f07792ab1691bb7cedb29137a85c8cd7c07ad5d6d6131ad042e98d843117c56cb1e0c3165201f29650fe6f96ed72946b9db57b1d2986a525aca3e778

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\libGLESv2.dll

Filesize
7.1MB

MD5
6c7d96f2c9b611e1a6d4a234360f4652

SHA1
f1a1e7ff9d20184316c5bf4386918b3149b01c59

SHA256
7d2a9cfa2ba7dfd17a4be7d573b66ce19ca5ee7e55ed737db60ecfc4d2413ca5

SHA512
99850f64f41c2accbdc0c1e6ebbf987842f51a5bcc4b600a5a351f7fb7be13bb12381c33bf9f0c095ad59c0f0a8f1cc21f63bd45e535e69015a97b777c2e2661

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\af.pak

Filesize
320KB

MD5
17e95507f1fa28c93fdb16462c5b520f

SHA1
bddbe3243a4a31f054317c9c83226e667b463dc7

SHA256
0dc74a936d57a465f877030f5c91d2e5e22c2e2af3c8733c96238955f2f18cbc

SHA512
f0c0aeac7ecbe859888ca3c7b2c6e063045930add6f8a188c59e10f6ed8072d9544127af18492008f1cc50181f254624a6a25fd7d3058fb1894e086d4b5e63f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\am.pak

Filesize
519KB

MD5
aed56748fb15ca4c96e4550051b460cc

SHA1
c0a409df2cb60d7cc5c7a23301445402ee99524d

SHA256
90e20a4038078ad45374ef843b405aeb62e954e1910adb3537c794055b8f2ace

SHA512
396ad3bd84aa1bc7dbcaf201ddf40c214b9c34a24fd740b7f731c866182c1f0de47461161c08e0135d924dcb594504901d716d4fe257b16c90ee1d88dbff9bb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\ar.pak

Filesize
560KB

MD5
2af71e74a1aae789fb3c7cfe1aec91ab

SHA1
b7ae04edcb8458af0fb14eb8f346b97f3dfc2ed2

SHA256
9274d60eddc28a261943258fa644587c4586e91c4bc415346f0b79b20676ada8

SHA512
a0e880b5fd46c8ce93aa166f87a228777d991451701358b63ddfc1280d49e6844284214ac4ae8b08896095a847af2218b9a33d5f504ac48c48ee365c1556c453

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\bg.pak

Filesize
596KB

MD5
03bdb0153929f96ad9ac8bad7201de71

SHA1
23703c372a11c133a954e974920480d7757eccb1

SHA256
67413b0b90b6646c4a584ca786a35aec7b4926fd4007e75d9196c944b46df02f

SHA512
8e59a8cfed7a68e9241e0838297d8acbe673622c2974096687ead33da28e7db3c829a7f1cd022f85d59a6e03774c90cb1dc95c874fc2622749471c9b76093bb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\bn.pak

Filesize
765KB

MD5
fbe7dc2b6bf403cde758eb515b7d4b8a

SHA1
1c16e86521818928ca96906237540cd8bc384d38

SHA256
6e2470842ff95bbe09cead9d1e22c15ee73231448fe6968a8d6f2d74e7c59178

SHA512
0846b96a4ea8fe406782ec350665e56a3e6ed5dd44958583a9ea5951ca246db1e47f6b25042e2b8443d131c679cfa9dfe6bff1bd90957e3d3339aa65ad986421

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\ca.pak

Filesize
363KB

MD5
9d2bec9781804347bbfc98b0168e5fee

SHA1
bce9eabaf5f94dc0c3fa8498a1611f22a2976280

SHA256
28dcc1c37459d9f7e450dbc94cde73eea2ec100f9e2d5729d9a34ae514e40f4d

SHA512
d1565cbbdf5fcf0192313ca6da1176e4fdb841f44452cb921f129b26c96b9b156c588716c7d98d7f286114acdedec2e0f32442c4ae8c4d34dcd86263bf592ecd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\cs.pak

Filesize
369KB

MD5
146aac893ae2282cd6f155c7e4246734

SHA1
453fefa0d412a38c3838b12387ab47e940485e29

SHA256
9f53df9c3e5658f7b9dec9900a671e06ad83601a59029fea0a195893049c5feb

SHA512
a50276712dee63121aeede1af7437a25670a9f8f76432154da8aafa8299b33af2ee9b8595aca84beecd8ab394690c8f80f47b5801cdbdb26e42287152181740c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\da.pak

Filesize
335KB

MD5
7222ed24c57c7f033681f6b563205e3f

SHA1
548f2467011ef0010db230a012fd4ec4d8df9275

SHA256
e211fed5abd72cfb641333414b4b2ae5f32bc59151d863e9cbe038a5d8390952

SHA512
46e0acb73a375d90f3f1456b509fef1470be5a5fafdd760eeddee1018de6a3d8fe720f4e366d4b87bfed451b954a47eb728c58d5a88dbd2b13f444264c13e6d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\de.pak

Filesize
360KB

MD5
d16a67c02f9cdb288e7ec3399994a33c

SHA1
7d15ba33c6263e65d91053ead94031c418ad23b0

SHA256
17b98abe332a2ee7d36e637b473742df9b3dbe0984e0b7380c547135601bdddc

SHA512
fa7daf53deaab8c7c138f5b95f2aca8fb8ce5817ed54ab4a3ea9c111be417bcfa9a485e29cfd53bbbd454f64dd29dd1f0339e650a6bb61b57ea03e534db30448

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\el.pak

Filesize
650KB

MD5
3137c0e418547ea635d56d95bcc77f4d

SHA1
e72180b19b378cd8dde175586053538fdecd1e84

SHA256
30acee7ec34d80bdda42f505a81c8a9a9ac24cb881f92ec6600d4f23cef2756b

SHA512
8c355969186eda3256b71f65aa17d6c3aaf9b9ca23a1b4b5c0265a58ebc1a029b1c0f998cdc00e61dacc96e962cddc4542f659c7d18076793dff5de2356e3181

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\en-GB.pak

Filesize
293KB

MD5
ca79f7e2286ea036b80cacd634233731

SHA1
79ad146ed5f7c9b505954e1d0278b582cddd3b8f

SHA256
186b697cfc4718c9ba3c6896671ef56d776cdf30f7212a061f8b2a6203b9bac3

SHA512
04aa99d6969f362d9795f619ed19f5d897b555595e266f51d8db2f6e9c317b87b4de484de16a1c576312fae6c52a2e020e946258fae6cdaf94b2d587518c4893

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\en-US.pak

Filesize
295KB

MD5
a2ed0e17819c287b824cae5c0ac03af7

SHA1
9694627f89cd65fbb511eacc6c785ab045525ff2

SHA256
c4a2c6a90945868a02ad14b3a994e94b123981d56190bd34cc3cb14f31f2270b

SHA512
a527351a1c61e6ed4e999c6549ec04b2096712644c4e1f28b48872c031c9f0a4bb118c0ceb40dc3a35315ddc7cf244e3c0c03d864a53d4a76f6dcf1b3889c109

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\es-419.pak

Filesize
358KB

MD5
5c880546a5e516e7a9b1628a27bbb002

SHA1
97651ee7d2dec4cbad48386ae3988dff9858b50d

SHA256
0d376b4ec905a41060b8b9de97f29c51a69712936ee71b4b96073194b15a7ce4

SHA512
bf69727e01572ed35bf7777d881b594a2ef6af4a6eda79db949ca8e7e7c4de2870b7d47126ae0438bcb223adadddc87fc388e8078eea299e39b2f5fbedf92572

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\es.pak

Filesize
359KB

MD5
a638e3161bebaf58c501963efc4040ce

SHA1
fb53a4732620555e30e10e40e886ee45fc4d653c

SHA256
e2f3d548187b5b02c3be595927130f097ff29bdeef6c063980c90b298b1023c4

SHA512
9dc94cae924f4ea0b756145541e4dc70a283d84805d6f103fe7069b15c865730f632270b81a11facec17bf3c56986d337cebb1904922b09c150e3b3ae05e2842

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\et.pak

Filesize
323KB

MD5
cd1025094c963017c56e6a4773c0d7a2

SHA1
c5e5e1569c34a09a95a717187c363edb37926ca7

SHA256
f961ca94397297a878076cc6441b31af1af75f5c2e705c8465d98419ae952c13

SHA512
68e6082480c1cbef270bef7abbe86b4321279ea9dbfb72ca3fb1c0487fca3d978988450fb466fda4b54d7fcc6161827dfd4a4f5cb7fca9077131922907c2d409

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\fa.pak

Filesize
524KB

MD5
a81decbf9897152106864ea10b4fcb2a

SHA1
28cf65a1e91163dac211372f82508175abcc6769

SHA256
d8a6aa3e91ef211d1525ef26dcd2e20819039ad497d789cbc1691f3cd96b58e3

SHA512
899f5e3ada4aead82b22f1cff0954cee843343407a0bf35e02a1c0d717bfc9c027405519f171ff0cdb9362df890d76b8ac0bfb6c3b12e88d3b1edb5273c6aab8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\fi.pak

Filesize
331KB

MD5
85870b393962d69088cb042748f2cfb4

SHA1
19bae1d64c54fb863b750836bb90931fffc7622b

SHA256
9be846e54800f73ab3b65dd9c11669b32706d2c803fa0257303d7d641d8def05

SHA512
5e11be5541ff3294eb2793778637d9fc5d6048ab71ada8e47006edf0cd870aeed9bd315c84dc3da38a9cf5491ef8b8edb617ca167ff31113f9b695ba6d88a80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\fil.pak

Filesize
372KB

MD5
8ea7c6702d16a196a9c92784ce322b5b

SHA1
e5491c608a9b45ff5f409976ac85f3fa88e01c03

SHA256
b6d1afb92fbfaca8ad9bfd944747f0683513d8862cc1948c6e61ebda1115f700

SHA512
36a842523cff479d352f5f4d4d952ac5e92300bc4a076f793b8f4ad86d1f0267e249e89c4acf4b78d9c475118ea4bde001632a0c3abbf2808a061595a0c74be3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\fr.pak

Filesize
387KB

MD5
bc86549e993fefdd1046d1c40615e4a1

SHA1
3c6a3ebb4d4d38095d8f6be09bb257242326f6e9

SHA256
3ce3faee3dfeb1c3c3eb8b940bb4caa16584dc0a64baee6ae86aeeafa228c09f

SHA512
ece233094ca5aeeb87299e02d23e1d499735d227d616307bbabecf8f070dc4e090941bd18cedcb5f3cae4c03d8f27e9097c0461a911e26582e16a2853614866c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\gu.pak

Filesize
740KB

MD5
93cc7570b7ca30b2f2138cabbf50883f

SHA1
321fe9cb0fc8e41ce07133db7a4fc1469f7c10d4

SHA256
719854191d874ef26ee5705d47280765af694c63d555d05036318e0e62918f72

SHA512
8169d9cd608ee19e5a8c94af3122d36a514733c7b22d1894383d66740ead4afaa8aca7dfd49a6203187625de85f30162c2f2676f913816afbe4197611615f995

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\he.pak

Filesize
458KB

MD5
61a11f620e56056ee7e08535dd4f0f05

SHA1
f69a9d567b8a9bc1b8a84925318b097441409304

SHA256
2b623033889cea25d2a8a99e275bf6e21489b33f8dd5db97c6572bf1106f6e60

SHA512
c2fcc4e4923ead4a5b74f1348069f7b58bcfabeaa68b727de1f68dfe98462d1d57005e0296f800397dc328473945f7342b3408107ea81a67ff68ff143d769318

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\hi.pak

Filesize
770KB

MD5
551e17fdf75742ec3363fe6d08e6b27e

SHA1
45d4ca9ba49f548e8b083ec8c21ee907d56b2ee8

SHA256
056db0cc0ec69f6ee09b46ab20ec8f24368b872c2e2334744a77c4aa811c9e2d

SHA512
56208041788a4b179ccc1c4c57135ab06bf026f2d5fdd32b749ffe6e4aef8ac7104fc9ff388a67cdff9311db2993948716c484ad4db3481ebd6c7a3fab57f6e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\hr.pak

Filesize
358KB

MD5
888b004f14c9e753b754e7d38d812477

SHA1
251bb6e060a9d5b35e018a5117eb9d5eb42c5fef

SHA256
687b7117c03eeed10aa37d089ca8346b0571ce2fa32e2ce2449d6bafc4703537

SHA512
1f78abdc46a51e79dda7fadd9b1ca062f97b5c86def984e61783f3725fc5665b27761de730afba1808a7bda219c68b8bb29afc6647fce69c6e82b4e2392ec030

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\hu.pak

Filesize
387KB

MD5
2da32b1023f28106a44baed81c7b500b

SHA1
f097edc07b6e97cc7370647c7d2055bdd3570937

SHA256
df0ec4343b4dc4a69df239548de3506f9a77bfacfd21b0aa4361ffa605d22ac2

SHA512
e2317c8ada92089f382ef296193ca8f158ac62f362398bf67774d15ecdf6c4db8bf0f99270f06feba6a97d61eade950f54bbea3b036408717fc78bc32d6b0c28

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\id.pak

Filesize
317KB

MD5
7132591d0d043f1fa6dfae4c98becb30

SHA1
afefdbfc8955087217c5a365b24d18e41def3bb7

SHA256
ab3cbd3fbcec3d7a8d11c9d3f38568987d6cf31b65c5da2bd3e13bf1ffbc40b7

SHA512
5d4f749281542f61189d1fb4bc6c39d9978e2abc5a29a7019ce48a7d52b65dabddd648ea5310adc7588030d22e1b578ab798bb4d8a9df958a129115b4aecbd3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\it.pak

Filesize
353KB

MD5
49030cbfbe1f35d6b9fc82657526b2be

SHA1
84ab1c241cf3953c6c542b1401d824aecf194f3b

SHA256
edc264386dda1d6093c584b893bc03b1b6bac40002ca5566354e076e16509475

SHA512
2a16bd01d71b30bc98468e791a0de93db879a56393c329d6c6fa854f2bdbe58549428e0491d0eee125255296f4721a3f7ab909fb9476297261270ecb7b786688

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\ja.pak

Filesize
430KB

MD5
c92c4cfd23113121c386939c6260ddd5

SHA1
5efe2ce8fc1d429b6ba64a2056d8c66ffa37cb13

SHA256
aac286df8c5b890611fbbb523a41680b630c27805e5d65f561ad1039a7cf6d52

SHA512
ce19f253f2dd7945293e26a9d5927b4996776c371e9a3ae89f879c5026a700b0acf33476445193ad9d7756d12a3975bd78e4ac3602eabc79f3e3d0bf791fae98

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\kn.pak

Filesize
854KB

MD5
df20fece71e63c32a43216522ac1ae8c

SHA1
e59435be9030383306d5babec630d0b3870c7df7

SHA256
173c975c5c42919ff5fa72f5515402b825b5b7d108462f629c30bcd046843f8f

SHA512
a2ec2f8e47247c4b0406d558e3cbd5f205ecf4bf5d11ecc8b2a6aa26f84fcce13da12ade45d37becf51fd6932b850256296112534c11a6cf6d96cf42dd4f7bb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\ko.pak

Filesize
361KB

MD5
f0b51d41b3391117fa8b8cfc4db402b0

SHA1
3cc481c6c29be98d3365fe0c4f5572c87b136585

SHA256
c723b3e570e233138522e790d8dcb93cf22ececc34fd5f943fe6aea75f7ce5de

SHA512
e1ceb83f5a31350f9fa1f312f6c7d5b135aa9b8c3d08c46abffcbd38e343afe03d41cadd36ab6e3b8aa249b455418631b97768fe2eebbe9cf1f3fda3421087e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\lt.pak

Filesize
387KB

MD5
38f69424e75f6e213e5b3ef204a1cbfa

SHA1
a519c40d601e3bf476019674dbc5dea851d347b1

SHA256
20edc43a59a72234489ccec63d598d82b9540a90df874400dbb01862cf4c30ed

SHA512
7c505b6193995f296a0032ddad6f23dec86ff8fe51713422b76d9b77c8c320f77f60d4405bd44bb734d0c7eb523a7cb38c30d59516b9fb45ab23db658883837d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\lv.pak

Filesize
385KB

MD5
27299b705bd28a865871e78fd252cbdb

SHA1
6ef01d0d625f14209ef4a81c88e989a2a1cf2fb1

SHA256
22b28ffa2d407c1138bb024a7bc440a3d62df39122bb1817450777b511167104

SHA512
a3ff51ef7f51e711f93d0659c987c9bf7b828262a5bb9d923fc7806fbcbfb23f66b6e6cd8041e955de5fe4c15e802043612e416a22edc26a81d9e613a038b7ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\ml.pak

Filesize
896KB

MD5
f0adae42b07610c55b5dbb9d54263ae9

SHA1
3bed262b4c2c5dfa219cf7b85057da8bcd6d53f5

SHA256
e256f33abb11ce7c04db51a6e8b103176ae38cfebf772846c19454c568c2ff52

SHA512
90daa80b2c014b903a989365417c352541b3838be1b00bc95ee00c7291e0e1a283b8716f02905e086317040e4c2e03f7548980a2fc3820ab3cd805060c489eb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\mr.pak

Filesize
728KB

MD5
4980cf48cf9a9d0c0db1ce322262b4d3

SHA1
f17b1339f2451883b9bfb674159ed868a9b490b2

SHA256
efce7696405acbbfb0393add0d420f1cff11d0028966a10162bf439beda3557a

SHA512
df8634e5be7880565178fdb183d9c4567ae6d188d3cd8c5092732a7f9da19c685f0ccd78799d628a6c5c1d3f739bd5bf88852bed8b183f7abd1136e708b46124

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\ms.pak

Filesize
332KB

MD5
af3f629ee9a1f6ef28a087bfc4735d42

SHA1
e49d9703937c15b31ca1f2cf3360e8bf4657cc90

SHA256
1911ff37363577ca73cebb803b8d076b77b7d8b7c81b7edffc28982514d7f46f

SHA512
0bd51d0c0e4fe1ac4ebb6dbfbd68bd986f5b827fc1412f913892614d4b41a24ac6b981752543f8ec82feaf1c8ead9d798ecf06fa8182bda8118e02f347fd23ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\nb.pak

Filesize
325KB

MD5
025b1e129cabd2ec1f7cd9b19c97c96f

SHA1
5ab2ad877a1aff52d450a9145ae197fab7b6d2de

SHA256
de03d755b7db3c9d20708c1acbf0efe73b2531f92cf5f0741900e0ac15707bd2

SHA512
94cd1c5d060ee6adf84da46032e41507571fe8b31846fa35a1fe64f6b0a06aa4aca3ca27166afe864997deb75ad9422270ac16466f2f4854e68cfb768e77474c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\nl.pak

Filesize
336KB

MD5
a37aee62d1c38d01c640278510eafbc8

SHA1
59d7822dd1c6db9e89c311180156624adeb0bdbb

SHA256
b4793c835f335bad7e718eb9df8c190984443c66d7458568bca11f7bad8ab4fa

SHA512
2aea71fed3164bd8f5ffd5eb4dc9abdab111a193d71a6f3c8521830d9d5c2a2f44f4a819ec3324cec35dab7152fc18aad7bdd2acb1e4c9e03cd6ee3199f715c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\pl.pak

Filesize
373KB

MD5
820518dd035e1b504c8b794506f56484

SHA1
01da91e7d00ef0e8de62161d0285b9b943a3b5bd

SHA256
28fe82312383c121366eb254c37ed2dfbe2493c6248cdac2b86de82feeedfb45

SHA512
714e2b72944a9bd4f732622ee2900c413d4b179cd79a5252fcb401cd75b9794382cd069041009cefd5aa69d331a5ce8ea7fe07455c58783381e3c85a8d33cb94

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\pt-BR.pak

Filesize
353KB

MD5
9365f268aa04d060e381217506741c02

SHA1
055898349f1b7024923c1b2800e799fdb6a726c5

SHA256
7e76684a6a86b0397714c9e5eca2f567529931e27fe21a54ed5fc124329bcbd0

SHA512
e29f436f899403bc751088038fec7964957ab55ac52d3c0a1a10bc98efe1cdd360081325f7d515e6a1ac5917312fa8191364aeb2f33c84946e53de4e36550644

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\pt-PT.pak

Filesize
356KB

MD5
96f5aeea0a0645abadf641d8e25c8297

SHA1
bd9af4bf7815d6b8aafa3069bd9979bff12213c2

SHA256
780471baed48058d9ac519ca96e6c18c18c14e9c73b207313d9bc497006f58b0

SHA512
a6d44a5f51a76a5af5c46cb825fedd01b64e4872b025e9d97e81d6ed415fedd123f767c34df3d0740d394e3c9a24dd2bf4b298ee26a991d11e46ed339aa36f42

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\ro.pak

Filesize
365KB

MD5
41495d709aede049bf63214d243804dc

SHA1
cddcc90705779003ed20760b60b7339e2e83fdd8

SHA256
4840dd4776b198ad61c8ea450075987d0c4cde0b976508906907039c5b6ffc56

SHA512
07c369773096ad96c3f49798e9c0561df8faae5ac7e106da2e359bceee711045e3c5292420d56e57aa0f4ba0ec46d7bc2eea187481a12d2e7875bc361dea1e45

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\ru.pak

Filesize
593KB

MD5
dc22b380e7f3057cd30a1efbeffe329a

SHA1
ce964424b3821561c77c47c056432b2dd0e0b9bd

SHA256
c0f56b46dd5e7cd893f2f8e79f9f5385a3906f6b51a5099f7ec2e64a7b508183

SHA512
ceb2be7f43ebeed2ffab4ab99ab64d8f1f2f495a3ceceb2c33201d7693fa160ec6fdd59359ef4809c5c7747f4ff8ad29a0f06e9884416514583208cdad3d6d3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\sk.pak

Filesize
376KB

MD5
9a609ad68435e0540c47a96ea0bc3cf5

SHA1
7c49ac1a2214a590693019f63f2a2ed7208ebf3f

SHA256
3027384e30d01e7d53d9d340b7ddd91665c7ec94881c8d717344bae354b2c6a1

SHA512
177b09f27bc69fbca37028b460012170b7b2a774cfd323585531e5a682fa31e4ea25ca1fa8a42f3c19ad370cf689e57487065e95c13e4058242c7a06b88d09c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\sl.pak

Filesize
362KB

MD5
ca037617ea943c6d585931a912342ffe

SHA1
046fc9ba9678e3fa3dbc1939ee180e6e1d72e6d0

SHA256
1b4f4fc0b71a8ebc8e74c44802cde3b6ed1abd4200d8b39ad296da0a06b62bbb

SHA512
d63ba528100e48f5eba7ba43b3b8f1dbf569915e99dac8eac22e89f832f72110492543578ea593fd50816e6202de9891164c9a7e9068a5458c84585b686f759c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\sr.pak

Filesize
560KB

MD5
880fc5fee125dde8c1dbc2dab16d4d05

SHA1
29c0f5f7892f6080cdf8d680972cfc15183a8f4a

SHA256
8b0217042d8c86d49cceacace04b324859b44d1ac51aeebcdb72c0772fcb8892

SHA512
cfd85ca23ef47e280e927c897eeeaa1a73c7117bbf8cbe088b79983c08cd6bcc4e51ec0205a37c94c0ef93cdd66ad07c340c02a4916f51dda37243b6a3ab2f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\sv.pak

Filesize
328KB

MD5
e7d2d089133c561c69a5aee13b61b11d

SHA1
f374efe484ceaa718f930f8cc5aac3cc845ce012

SHA256
dfa03fa63b4b733829bf107c6944ac0e7a66d1d3db732e90504b1afc80565fff

SHA512
a2195896584924beef21bd4dc306b2f6905b560a94fc10777096837511d90dc22345a8431036367e4962d8d0ac047ca3f15f5a04edeb0d7e0d8a2905de85b61e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\sw.pak

Filesize
344KB

MD5
44bcc75b52c0e2862cfe98f0d5e40123

SHA1
7b47f4a439fd84a99725c6dda369fbae25e26072

SHA256
5396975ca7e1b93da5cf32cfb8f392ec8f9fb1c164cf24ad0105323ccd84ff49

SHA512
2870436e2dd61badc2e5475151b989feb1f23ed02f051c3a159429809fbdd13962f5b6395f209f031808a2844cc7b1c7e509dc5d9cb52ee6c1ee7dc7c8ce8b9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\ta.pak

Filesize
880KB

MD5
0fc74b600b04f49186800fe79f6039f8

SHA1
b60f34b645c7746cfa96b814f3f48958ce8d6f53

SHA256
7529454c63a10cf54e283c7d6745b4bb74476cc5602f37ce090a06e80aa84c9f

SHA512
4d88903f618f37b714e5509f7b0336af648a76e4ebd15a1c1b56f6c21c099ad9133c9e4a0c28a0ba73013bea01bee87ef083df72c323b876f5b4a2a506f898c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\te.pak

Filesize
819KB

MD5
b9d6879ee3daac38e63a29c06689b5f4

SHA1
6adfc13a6f8a1caf681b9910f40899bb7d54275c

SHA256
462deddccffd0d5bb06d94f69988cf58ec6f89a2ab9bbc80672c3c5a79bacdbb

SHA512
4eab2f6f06b3eae35ff8b55fa6efbc67bb883a0735291f0414af0f5bd9b4de83d2f9022aca6d747df1f39b0d7acbb1fef804ffc92c77ea6d9080ea60e4431f38

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\th.pak

Filesize
690KB

MD5
e7aa2ab72ff12d546f3794beecc235ae

SHA1
018060aa8412988559c59d155435c5fc1eeae34e

SHA256
4cf9c52c112a1b4cd3563869518530662eaccc93c0f118ac15eb4571fd369d96

SHA512
a236e19173790d43d9049d0cc00361c44934d6e8ec6a4b77dd1c4a57681fa66c6007c258da045c8b67f799d51195f2e11fdcbd873bda582f0891ff126a072e45

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\tr.pak

Filesize
350KB

MD5
9cce758eecd528effb7622997ce97f91

SHA1
5dd837f4c850761faffb424c80de4157605d66eb

SHA256
797aafde72761531697d23cc5d41096dbfaacfa7b83ef7088e941e9284586e74

SHA512
bccd704a3960c661eea89a5e6c9f1667b30718ff7763431a711b2d6d139111d5dc57646b6943bedd5be103bf8d3490b704848746cc0d4642c6faa2b46b668de2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\uk.pak

Filesize
592KB

MD5
316843f8dc0929f8349d6b2b6f5a1f04

SHA1
8adcc3eca19451edfa1e45266e25e8cca820386a

SHA256
9e32b94743f9f24934e7d8ddc05dc3bcc1f7976b7355a29c913786af65699009

SHA512
1f4ccd1045496c4610bb8d2b75bab20a32dc67ef919d0db8600d804c50e0f17f65a0c6d894850c9be95a4f2faf300b2170699fb63012c3bd2ac08a52fa4584f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\ur.pak

Filesize
522KB

MD5
d7ba85fb9a1fd2d2ea3cd9cb36ae1f82

SHA1
813296ea7216966f90ca1682c9650194cf879012

SHA256
b978fe26b397fa7cd106821e405294c57567452ec95bba551d0e1a6cc3531781

SHA512
077d563c2cb8145558db9f9d0b34eb36441e9e77067714c6f5855de85fd90be0d64dca39df7673ceb8bf691922483ad53b9b5afead069db400abc0016dfa1643

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\vi.pak

Filesize
415KB

MD5
4362e87fdebd019ab4f1cdce3d299fd3

SHA1
b729630e7c25b9f0be05a7572d3af7db4b7d09c8

SHA256
39e78c39df1c4bad98caf9e751370770ba5c9f9045da370f6cdf79a1aeff556f

SHA512
22e3a9207eac596343cacd8d5a19343dfe7e34af2d5d29674b759fb2fbce5ad290e01ec7ffea8794626c32dbbe773035397280100d08bf73a2e6106ad4e33ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\zh-CN.pak

Filesize
301KB

MD5
73ef8bdfa58e55fc0753e88e34dd6eaf

SHA1
bdcdf0bcbf1987af2c98d8b38d7ad59f2722c88b

SHA256
08e67aab8349a07b98cb8a17dcc582c8de0411906d2851bc93be76166e2773a5

SHA512
49a9659d2f31251e3be77223063978e09753b2d5932eabe0877d53fc8b80e0dd2e149cfa9d2cadb3c7d3cc5bc5e8f1722220f3633bcc81343669f8763265ed4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\locales\zh-TW.pak

Filesize
298KB

MD5
c9e20aae96b264476191f1b14b446905

SHA1
56dcf2f68e82b6989d1772187481140dd21a35d6

SHA256
eaffdb916700bec8e840cbaf5de8f4032c519cdd6c089bb95ffd13639e7cd3bf

SHA512
9749d24778d57ad6b17decbdd58036bd1f8c89f3aec6319ea640dec4ce65fca5c4ebf21e7d0ff4a22da816a16b467fdfa26273390765bac6744918acffd18833

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources.pak

Filesize
5.1MB

MD5
dacace0ad6d390d392b7dbccc92323bf

SHA1
0cb6780041464d9250cac0a8cf9809bd8c1a8338

SHA256
b428b9d91626ce69d0a4fafbc7f0062ad46137677da53bd649dfa8e8d01ffb69

SHA512
84ad6328c9ccd54dec116b0c729ae14134a106c3b2b63faa967b94cc8a5751ac4f6e5d0fbb4cd7a39096a89cb8f0889ddaf2fef07c852a6dde8bacd790c818e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app-update.yml

Filesize
106B

MD5
86826f3f895520a3ca1b0fded246d957

SHA1
aaaa0dfe8a39ebbed9baf280489da2da16a5ba42

SHA256
a0811a8f44ac545b16cbf6028a0fce1925a58ef4d6c7b11475e93b6218405dbe

SHA512
574a938dd0a9a876aa6fe72ead33e120b7478445557f4fcbe38ed6977dde17f2a21464cd4fc5a8808406942781412681fcc02081a560f4ebef52f5c379c094e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar

Filesize
181.3MB

MD5
1d3a991def3e8cc7f1057f44ffe286b5

SHA1
0114a534beaec72fd6aeb75d853bd18c3aa0da58

SHA256
4a067de96778741672ecc7b1fa3c804fcb3619ce7aecdafbc1d444fb7464e400

SHA512
741e2283a3423507fef7a3d59e13070575bffe0937bfb09a2f3132343fcd3c9165215e1166c2a1e823cef0c9ef4eaa1b8997059b9ccd071be36a89b398fcf43f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\@testing-library\user-event\.all-contributorsrc

Filesize
3KB

MD5
df928769ce70a261ed37724531ccdc3d

SHA1
d5cc38f502e931c860e7799133faf29a7352ce44

SHA256
e02ba2534d0c6f1906041c30399a3f86561ab4be6083eff7c89363c7a831e83e

SHA512
ab311a32ad6846a164bdfa448f36d205ee2ae2eed52b34a2b48b4f6c72016202097b29e1228f29e57c3c22be8686befa3873534d832ae601f15c24c43cf90273

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\@testing-library\user-event\.babelrc

Filesize
161B

MD5
260a25b11b0bbcc6a49ce68967898d65

SHA1
e698c21d3e9dba39d17244a68a8409cbd7641f88

SHA256
908a106c54be08dda774fe0559b07d01ad08a2391e8c5ea289a67c7095c3f9d8

SHA512
8b09edcc2b98f7e806d76ad8acc88b332fe53f462ab515499ffc3bf4cfa96d04abb12c1f2b784ba480c4d40295441a03eaeda3f9fb6e1d75a215acaec7c84e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\@testing-library\user-event\.nvmrc

Filesize
8B

MD5
523d5baca4b1ca99624a759121a2618b

SHA1
a93ed3ef0272702ad0b998748bdb30700d92de25

SHA256
207d5c2b13451c595e0c96f0b795af125f9d76bcff20d2f6def6273ba6138fca

SHA512
59d52e6778f133eb6d6cca62b86038727aa13c1d375fa50a02d02a71c3074fab68f9b11b80ae184646ab8fd746328e3ac921a25ff8e60c45c3dce137485b2b2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\@testing-library\user-event\.prettierrc.js

Filesize
44B

MD5
04dc47b07a48d910dd755562cc2fda05

SHA1
e39d3d945ba6c559c9d7cbd2a70b57cd67930917

SHA256
bd8707d98093c37d96b500ad69c4300b71e9fbc86a0f12ad620531e315bb2070

SHA512
82b094b5c898aa5360e71da023044006865a738d6d1d5b4f730f8118d1e23b7029e9cdd7b68c964cce802ff543bd7c9110cefad1a3793fb22d090ee68c66ee24

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\@testing-library\user-event\LICENSE

Filesize
1KB

MD5
6b622838680f3e102668133f75cb34db

SHA1
374fc5d8ccfd31cae68d737546681b4306d4ef18

SHA256
078a464855948a00a00b1fa4ea26ea8ebc291a373e901fdba2011979ac03e4c1

SHA512
192f8d76e193c7886a5f19a84f1735bb003f6af915a072d5c35b5f387a89b71180c076be5f13cd2b43718fc217e7156d1c9bc69f0b8dda5ccd5b4ad6d8f53393

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\@testing-library\user-event\cc-test-reporter

Filesize
12.2MB

MD5
375d0d086c189b4bb5fc2b3867c003cb

SHA1
9c3f7811dff9cf1f8c1c236d670e7e60c17ca079

SHA256
38f2442892027f61a07f52c845818750261b2ba58bffb043a582495339d37c05

SHA512
214ab5bccdc392fd32a226c4817d33642f7a0f73aa94035e4a3ba00286f1f37a3b4d483c971db0d15e81bb9db00ff557c3073a9c51ff76c6f6aecd927c01eea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\@testing-library\user-event\dist\index.js

Filesize
7KB

MD5
cb91be3041d1513f575feaee30d2bb81

SHA1
81c7242f1754d81636c06569f66066ed79f99d7c

SHA256
7a15a99369324148b59ed699de5be99c6234494b00dcee970e362f9f8193fd4f

SHA512
9f28f9b3264178f44143220ad8693e3cded53137b601241307f010deff29278ecf7cc439d2c86b0ebc56607be9e99f158bf4752fad7545b9e8f3d34f07631573

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\@testing-library\user-event\lint-staged.config.js

Filesize
500B

MD5
97d3089c53368dabed7218c925c516f0

SHA1
95c71524c862059d3dc98f3e92da2e745f555544

SHA256
6d34c382492483fb815160a91482460c1dfeee72242e4b5b99fe9ed702ba1283

SHA512
44647ccf7f17022f1bcabf1438b5e0eb332ccb825d223081487ef2a6f0b429052c691807757883ac146e2f2e48dd65c7a03354d6da9ea50473dbe779340d03f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\@testing-library\user-event\other\dog.png

Filesize
3KB

MD5
294aa509dd520f2ce2f30f9cb833799b

SHA1
584d0cb1a02e42f148d7967b336262b8409804d3

SHA256
a95e2f736b58685c1cabf8deb023d82eb4c5300e22c259ac4bbb4837ae277435

SHA512
fce0be72f9aa901a1b668d78771ad050d5faab0f5ec96016e871bb51d6e678592d27f893a4347c81955c36f10de03112a869be75a993dd24e858e510b43c82a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\@testing-library\user-event\package.json

Filesize
1KB

MD5
5180e9c253dfd0d26ff01235583837e8

SHA1
a341447597819fd26e78c62f4208aea1310d9b46

SHA256
fa215146c4a8194528beb763a8c356f5da1ad23eaa7cead5a6c136200d3091bf

SHA512
429b9f9f2875946974fdc2785d18dc109e05156d3f6bf56ac2825b15fab8569f6ad01860d29841f93111c10ab2c6af45748d7da9bc1dcdedcfcf77de07579b3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\@testing-library\user-event\src\index.js

Filesize
7KB

MD5
ad4c20d72756845b08747264ab200cd3

SHA1
6c088c9eaeaa09f34dda520cab438cb757ebac03

SHA256
9f22af8e3655ff975a95e917826281da860a803a5b1285e356a89db3c81f24c3

SHA512
59883c6b8e642d2c1e63b01555b8ab765d564c2a7e4e55350a42bbde9f9827a2247b7889e1a053f972622dceee3622e6e06cfc047ce26472cc6e9f572559590b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\.prettierrc

Filesize
46B

MD5
fbb3712ba21a46654d5bd9ae31ea9abd

SHA1
4c29afd854fb088d155df996b25e3fb90594411d

SHA256
3ddf7961125a3524f7b06e696cc578259f87f57584b8d69b461873dc13910bf0

SHA512
e72faf858faab786c2901b7f5552332af6cc03c0a056d1fc62bf06170d25de84c4d967e21ccb712f478d886e628cf2b977aa34e1588bf6e8a63432d4c2285593

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\LICENSE

Filesize
1KB

MD5
3359947cbc36ff45b55bb830956f06aa

SHA1
ac30774e2db317e4a5ca1dfd150fea3c0b818a82

SHA256
c5f00acfdb0120b3fafa9869ece941c0a095253770f652927da96352b502df90

SHA512
465af14db0693bcfcf2c13fa83f7c8ed93e8595bc5b624f0aa9d3a9b41881a965b11ed5ad3ab2a1193c628d082ada1be7338911daeab732f1f1f4415a638a9d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\index.js

Filesize
1KB

MD5
119f3af96835c9d3e8c388bb31c099ae

SHA1
f75de713c76f69eaafaee3c328251beb73932b85

SHA256
e85060c605820a1acd5fd5aa8b149d4fcd5bef5e498a80392a7a1b68cac43d62

SHA512
fd954640e43d93b3c3de3285ab46a313c8859f0d0a5f587be4c168671aac3932eeb9c971eba2115622effc0231ac5fa6e9955babdb43954987fe2e17461cee44

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\lib\checkGrowl.js

Filesize
536B

MD5
a7ab3606eb740b8b43a36c25fa315087

SHA1
171e173709f00ee5028e38590e5a992a0ff7e4ae

SHA256
6d8fdba983f2589ac744b68437918c63e679a962c4e06007b4f81cb089fdb103

SHA512
8a907c6a320738d1f1f685103bef95368b4895b8ea6f82a79fd62a37bee9a5c085cc05fdba1477892784a26b4b0f5de58f630c150d8d24d7741e52ed3cb52406

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\lib\utils.js

Filesize
12KB

MD5
860d73d5f2b7df6ac94b1fd9bb0a8722

SHA1
e160f5144a23f02aa9febccac04175ab634583f6

SHA256
97aad0d16fb442b7f7f4262bb7e27d6dc9fc41060ad5d876c36878e4bb011bf2

SHA512
aadad5de3468f125ccd7f65364d84efaf63af218273598616589221c494f67e3af4968e98bb8045f4f6e27aaaaf8f1c9aa774099e050864ca59dad437413b5a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\notifiers\balloon.js

Filesize
4KB

MD5
4960ade286e33c22c77d87416deb2600

SHA1
11474f209f23b3371227e46327220b037d26b094

SHA256
0d2f65f5bee22e3ef06e3bdfad02dc476e18fc65a7c2572c29f943a1001c5d0c

SHA512
8df3c6ddeb6fe8a720ffeca7f2d637abe43885450cbff93ba9cf244b209d87cde1434bcfd1b9ef9bc26f6cbcb5f00a5696d105a4c9cc008f66f9267c0031f82f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\notifiers\growl.js

Filesize
1KB

MD5
52577de435ca2bfecf74742bdfa8ef61

SHA1
03f40c0a041167adf913baddc88e280077c2ced2

SHA256
33e91460fca7d54f27d7d8d569ecffa6444e03624881e74cb490174093069bbb

SHA512
f4d02fd387d5e37f9198ac9bd04edeb49dc08e8d6d2aed598f8c36a911074569bf9970acdc826dc3193c5188cb50fac80473ea715aededb0f606ee007490f09d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\notifiers\notificationcenter.js

Filesize
2KB

MD5
411034af5215cc8bbf19426e658075d6

SHA1
0d7fe541bd4f2afa87d26b2db8f40c3e05adeab0

SHA256
b4724a9422d5d15d7148ac08a3f299f06443b55a65ed2b5f87a6f4d88f9a122c

SHA512
4f68295a94eb76f2c026d364bbffce52b221bd7a8fee5ef7d9e6526cd314f5fee0c84be5cfd5e2776d9789b6293d95ceb972cfb3243ed12efbac465248b81cac

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\notifiers\notifysend.js

Filesize
2KB

MD5
c7bc779322d779dc86fafd90c042eddf

SHA1
f594e7ba8a251c04ac7ee072eaa44f1faa58c750

SHA256
6bd1e4987a4cab694503737d1e1f19b9f62af695e85a4e30b8a868313429bdce

SHA512
8e76a601dfc7cef421755e022e444c79bcece82a3f81cc89d1770930168d0cf78155f56894a93f7a654fff76128a6317f6d6b1c3a3e9195331da401a2f28ffdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\notifiers\toaster.js

Filesize
2KB

MD5
ca33c6f0035c3c2935df27472a01939d

SHA1
aebaefb42deff6e4fd11591b9e1305e94b2d9cf6

SHA256
cd945dd67095b22d9302396bb716ac654c3a79bc336cee486e27fc446ad49041

SHA512
cb678bfb56723f8bd632e5412df998a060ee53514a38c365e3a41e6737bb18a1bb481f923f0ad132141d09d19276f81cdf3ed7a3ec8b6523dafac32eb76e1a2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\package.json

Filesize
1KB

MD5
8929d0b5fc841c5e34dd6fdc77582da5

SHA1
ed94e26b70cae43dc53ad086fef0e1eca64808af

SHA256
adfb2a4b27233cf273b7c68fff2803d79ae10d38601a9d867bed9d2eb857ea9d

SHA512
31360f30c6309bc62cf66069c6d17507d84509d9d7eb8f467fceb6b5b9125c60ac220eca2d195dc130001b837eb3ee4e60862c9de23bb2d7abaaf697e3a31fc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\mac.noindex\terminal-notifier.app\Contents\Info.plist

Filesize
1KB

MD5
5812200056cce520099a88347a819d1e

SHA1
10f656b2b3854ae58eaf4369232525163fde90e8

SHA256
24a13344667a084f692b2103741f4d4ed8bacf5a53e2abe508f10423c5d6b27f

SHA512
a553893b241178b8f423c1e34001550f3f074f5e396f2edfd1c243778348ccfe64b0195587a42181e8d9570d516704fa920241be2822741d2215e29ac5814cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\mac.noindex\terminal-notifier.app\Contents\MacOS\terminal-notifier

Filesize
85KB

MD5
ade5227f13963b5bb72b47f0ad410819

SHA1
24d1a22cbd8b026c35b29f1981f4d9fdff08af37

SHA256
2588f4ae2118396419767c388cf2b0a9a5e0cb53ce5d05a07c00f68a97a50215

SHA512
ee702782dbd44682f0c9234fbd2d256b14ee70f349186f37e025bdac20ec5b10d515e9d91e6b54a5df7ee7312f2faf4d299e1ba1e03419cfa52585f2c1195fb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\mac.noindex\terminal-notifier.app\Contents\PkgInfo

Filesize
8B

MD5
23b7d7d024abb0f558420e098800bf27

SHA1
9f9eea0cfe2d65f2c3d6b092e375b40782d08f31

SHA256
82502191c9484b04d685374f9879a0066069c49b8acae7a04b01d38d07e8eca0

SHA512
f77d501528dd0ced155c80406cfbee38d5d3649b64d2a9324f3d6cee39491eb8f54cdebae49c6e21a20d2309d8fae1b01c41631224811e73483db25a2695738c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\mac.noindex\terminal-notifier.app\Contents\Resources\Terminal.icns

Filesize
360KB

MD5
20c4ead98b17946b21b207c59d9a84af

SHA1
3aaf46b493350ea7061752421e21206f486837a2

SHA256
ccfc0f457dbbed2b164a9f708e1a0000fad8f896b0d5332b376e2b748f3ff525

SHA512
f0e8557e37c3aad01d80c4bbfe36eb506164cfbeb689934b300934a3ec46025559dbaa9d5d725a9b5f0b6a1d0dea2ed8f940fa041bb1756fb0dc7aea717c5435

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\mac.noindex\terminal-notifier.app\Contents\Resources\en.lproj\Credits.rtf

Filesize
436B

MD5
f0d4a61caf597423ff07c5e9b24a345e

SHA1
60a248148b319de26e36424d25021c2488e23ce8

SHA256
b4386fe1cef65cd91e6c8ecc065d117089083f91b7cadbf0c3e5eae20e8b9640

SHA512
e361011499cf70fc71e247fdda71f49d913654a983aa4ae67d00dc977e53b9cf0d88d4d2ac07efe248261c3ab6e3345e829e22dda3e51dccc221a94c660ace69

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\mac.noindex\terminal-notifier.app\Contents\Resources\en.lproj\InfoPlist.strings

Filesize
92B

MD5
51ef59b60e5b41b91519cc662a9fe886

SHA1
3222ca0c39eb50aaf8126baf852e55430c4718af

SHA256
39cf2ee07b7b333e7c179d0bf4d798a5b72af6a4e584f51e642703bbfa4fc828

SHA512
3952a908b72d44040f5072f6344f6327fc78981c3aa55e931acae84c0c9bcc0d148991cd564af4803765c328cbf5f7efe9eb558fc56e47e8206b7b706026f30a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\mac.noindex\terminal-notifier.app\Contents\Resources\en.lproj\MainMenu.nib

Filesize
25KB

MD5
27c712a6b920b5908ffe207ef1eb5dd9

SHA1
97af8138a9a90d74a6cea6833df3c0cee775f836

SHA256
66a2378cee667b39af5a92676f20f2db13dcf73cf2d23d2a30ef140cdb71f1ad

SHA512
50086e239d8c791f6cadd9a2451e6842646beba6c39b4b63cd9fa9a06f0319becd02791a3136efd3268053f82e9b676599a64e4d42a254ea8d63abe97e76cae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\notifu\notifu.exe

Filesize
253KB

MD5
e9d3197b3a42c7c34445d39d8a8b7133

SHA1
f1307fa2b55baf75b87c8cedfe17ba4bf7d76787

SHA256
2e8aef4009680de1f76f121fbb6c7f66e669e8ea4b3a2fc68f86768b7416d75c

SHA512
6bb142e69cd4a7529f1d8f9d5fec44048d4e9dba000933e36be6a67b89e94d5537774271e2a4179adfc4256a39ab65583d49ea97858fcea6bc228d0d35a10983

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\notifu\notifu64.exe

Filesize
303KB

MD5
45ea9faa3327e665f8c25c844d80dcd0

SHA1
e9b6b0b3aa4d0fc917beb72c140ed32538673901

SHA256
c686a19386978892f5af0cc36d079321a2f504c6c9db25b63b70c62d6752e476

SHA512
9a67dc394ccd304768f658b05adef17fffe7dd01cde771243d160218f26878c59a87499dcbf3f353f0b90631997001d00796f44269f36db436b18dfbdd653487

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\snoreToast\LICENSE

Filesize
7KB

MD5
bb3ca60759f3202f1ae42e3519cd06bc

SHA1
c09f9595f49b611cb4815dac18057910e5ff66b3

SHA256
ea8af5e789cb2d4e9b10bce3874982ade163b749b6bfbdb32e2df21c4d106de1

SHA512
68b7cfff760d681a2b8753a204e6470afdb15929497745287d73b78b4c9160012544941e0aeb4ae2f5f7f4e4347bdb5172e1af94dd9376c8e9fe00326548f514

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\snoreToast\SnoreToast.exe

Filesize
291KB

MD5
38b842e8c3504d85e8008b0cb9b940ae

SHA1
22a25c731ed826d0caab9b3517b90a4e75ef03e0

SHA256
8968eccf73feaf8704d6729239de04fce49b582cb3dfab869e7800219ba49a69

SHA512
5a9ee49164b76163807118543b0f75fa8f3259a1aaeed1467acfe3976e129d809faa5fcbfb9eb183e27ef92ccb65cfbf7fd8b37a5f7f6e7e4637dc3c850f32f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\terminal-notifier-LICENSE

Filesize
1KB

MD5
191db4e4fb4f0164cdf521b3ba0ac98e

SHA1
355f9a67f5e1306d76b40a720522c6999ac3c466

SHA256
77a2769c8dc103f8051ccabab083c18e4cfbd26ba51589f26278c94dee997e56

SHA512
215fe158874088f703ba003f1b163da7f99a8bd7727ca0a39406e4f51553e7149630731a78ecb573c5eeb56e04af32d984f1db2b85ccd727b0a59c52ba04d7d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\rcedit\.releaserc.json

Filesize
189B

MD5
c896e2730f6662e1645901b01bf37658

SHA1
8aae720255ce891581077ec0993c54bd5a915644

SHA256
5ff07e0b0f1ddc6b0e6ec4a2df94939bdb14e8bb0cd07957c53afcb8a2f8f93e

SHA512
b0b47beb9ce8d704f6056d74067624487e7f4475668b89352a07aecd167299ea0fcaa14c1d109cf4e80cde3766ce0b482e816a119f0b4dfc7fac2532047671a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\rcedit\CONTRIBUTING.md

Filesize
854B

MD5
3f334c61cd694d61c332fee9367835e3

SHA1
9301356c6299256d441bff7c5efc9db49a315dfb

SHA256
b18e5cc0e263c74fa1a3a23946d0f46c3be50e1f2d6c1522c27026f9fe8a0706

SHA512
dbf9ec5ee2f871da006bfe2c63cdb8dfddeae9303fbe585b1e2eff16d6475505ad0b65290465893ab55f4905393d638ef01bd136d908e4629575191e228cc931

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\rcedit\LICENSE

Filesize
1KB

MD5
972f323aee98757c51dc8402e7e7f24e

SHA1
58f6c2fde51fc0d501d196eb4107555835f0b890

SHA256
365e2e848090ff97ffc97197654e8a004bd2e13f9b216618fdee394ac016cf79

SHA512
0713c51f5f738cf47e5b3525d3e98799a7f55bb85651eeecfe5224b08519f145d55add2efb283c39b1ce340a2726e0ee6b9b2178603eab90be68b4bb133f6bd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\rcedit\SUPPORT.md

Filesize
474B

MD5
3e4048d168919b14b51b46fb76be2fe6

SHA1
e0c51d80481a56fefb7ff7968c2a94c7bc92e767

SHA256
61214a4a79acc5fefa019b9b9063769ba52891587ea3e9cae30c2d84492aa93b

SHA512
42a1bb8c4629f26be968313ad61e2163624008a728ab0f1b77ed0be9b91645b7cf2fe54ce9bac35e3f2c583dd6c08fcd3cf9ac2d93a300d2255400acd4f28481

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\rcedit\bin\rcedit-x64.exe

Filesize
1.3MB

MD5
dbe5f815ec0d50c31ab6fc18c805e5fc

SHA1
8a35a856dd941411f70edb284e8ec9c422d0dab7

SHA256
3e7d74e5d9d729df8b26b2e5c56916b13a4a4981c3dcb6aee9c4f5bf4cacb0d9

SHA512
da1a2098cd17fbefb7272cdb3c72b787ee9c1ec6f00a74e1eb8d4c4ba63b8113d2b923ab212cb66099815c075912928c9e1c1ff2a5cf9005e9ae25ea0e8fc161

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\rcedit\bin\rcedit.exe

Filesize
950KB

MD5
93b951ddf6b7e9af375b0d949a17628e

SHA1
462a0e10bf4c2278c4e2b8fa9ddee3ac9e7d2a36

SHA256
a34cb7f9930b34fe232cdb0ece9d773b3c63804cf6b2b17cdfd1377c57f2e9f3

SHA512
09e1efc8f15656d6f07b71931240bf7bb8af6ec5b965ad4d673e3d99032fe148eb5c9598e57292db3e155f963fe3e6d31502fe2a35858b6b9bb5719ada144902

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\rcedit\lib\rcedit.js

Filesize
1KB

MD5
d1a127233675396405dd67ca962e8a2c

SHA1
471fc4c6ae7cc065de27ed462bcbca63383bf8b3

SHA256
55d6b171dcaeae77f89beba245c39c07327a6584ed847082a77e98473638f557

SHA512
72bb0aeee4f109514b19d6a387dd078ca47097fb162229c0b314d290f454c7fc2fd60d70ebbb4f2566d9cfe841c5b4edcedf10750790017c7eb0318a2394614f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\rcedit\package.json

Filesize
746B

MD5
14e68e82413db657d6da7ec9c28378f7

SHA1
3cac0bd8871c8122aedce33a767420947babf289

SHA256
18225a6f83126e64583c6f28e3291574c6b2f4fa73ca712d2c645a7c8861d9bd

SHA512
a12014d8f5df79705646f64a7d2c5091c4eaa1acc9e39f329ba841afb1cc97a03f596ce3044ba4a9595c51a128525f91d4f12ddaa09d49029af4a1fe1da3bb89

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\app.asar.unpacked\node_modules\rcedit\tsconfig.eslint.json

Filesize
299B

MD5
8fcb883b1addd51fbfb6b1021954f691

SHA1
2f2b782f0917746a9727eaeb4f88c223353593a4

SHA256
02b61bd1d0b0017cf04f5c5dff699fc4ddc9f287b7eb35daf614c0996e940273

SHA512
a5cbafa014e5ade99d4b651d77a755eab51f4b58133f7e3779266f349fac27d036923f8fc1ce8760021cd961023e7a6bc37b8232d1e6079b61d5f854bc3a0baf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\resources\elevate.exe

Filesize
121KB

MD5
83c3c3b2d5fd637fad1f625a3509969d

SHA1
e33fca1f2a7f219fc4821332f77d544892f82ab9

SHA256
ae8f8308a3dd81dcf90db4022f6d49a8572e9a4dfae66c659f1886f33ed0ad77

SHA512
21af58e9cee8d0089fe73e21c44f9f4c0c542248d6f91ecbd9faee4367bcce878b9b2d4f926666049f38e50513014dc478a149c7d2c4566fe809fbc437948162

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\snapshot_blob.bin

Filesize
401KB

MD5
98b334e57cd2b6f0477a075b745454aa

SHA1
652328e91a0ef0a0aebc595f46de378437d7e4c2

SHA256
bfccea28f0202a963449ddabfe210182b03c2b58833742d388f0e6eec3ad78e3

SHA512
f5bb43b20ff79dfcadff385a69791eebe92a0fd2cbe4e8cef0d94de3a6be3a84a74a4f1f30eb275615aaac132bbe379ae7e03d9fdd41ae8eb81e849692e3b3ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\v8_context_snapshot.bin

Filesize
716KB

MD5
25727ffbdf9cc388e7cce38bbfbdb62a

SHA1
4dc875473b0916ecc602e6e0fc851e460f574be9

SHA256
83031cb1ea99bd520eeb4e29683077163ed4359769d84bb78d373475fb95b1cc

SHA512
439c1dfa8e98a0c9eb62269e4722fa8ebef06fe98149fcd95c5f0f516c07d82caa4975ea1dfe3ab1cf011ee5d29d2f67640f36bdc9cb5eee2cf16d50d4260bc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\vk_swiftshader.dll

Filesize
4.6MB

MD5
18635be2c1e181396d39d0e9d71946d7

SHA1
9a3fde769a388ee6cab5533e6b0dd641e5183332

SHA256
f3acb20238bebcaa9f3bacab3177109d8b8d22fe3ed5261a34f3aa900516faae

SHA512
4166e5bfec4370f15612a5be2b0f2bb77d2ea04064e3c0cc480ab2c0835c621e45dc5a0280aaae4ce8a83d3975167ea9665f15b0efe7248a5bb3afc0e346144d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\7z-out\vulkan-1.dll

Filesize
849KB

MD5
dec55e9801fb0cd701110db783cd9f19

SHA1
5208a98342129eeda56e15a2b113716b57b75367

SHA256
613064ac712b6b3b93e2b58b30fa119c1cae2902d7dcfbb185840a9b80ae1f83

SHA512
9f81c26b616c94e9ace9bf7a4977ba00c05912c466864956d9634f01d6d6f458d1bbaaa4e5f46e297dcdad729a907cb3169bdfeb80534c8f397fbce72f16abc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\talkia\Code Cache\js\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Roaming\talkia\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
e4f8ee5487e24610298671531966bf16

SHA1
dc83a350a0e40132e33cbd4924cdf8c496f165c1

SHA256
f9fa55ea5ae2d2fc4c69846feff9ea4ddaec14c9d7373424ba178dc7c9822b3d

SHA512
60706541436356f21d82a8ce0abcdb845b6e56ac2dfad7ffcee21111a371e2f941d5c0a7954d55d1024eee1078335c42aa4cdf3d42b8eb7bb684d5b2bcf1e424

Download Submit
C:\Users\Admin\AppData\Roaming\talkia\Code Cache\old_wasm_000\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Roaming\talkia\Code Cache\old_wasm_000\index-dir\the-real-index

Filesize
48B

MD5
e4f8ee5487e24610298671531966bf16

SHA1
dc83a350a0e40132e33cbd4924cdf8c496f165c1

SHA256
f9fa55ea5ae2d2fc4c69846feff9ea4ddaec14c9d7373424ba178dc7c9822b3d

SHA512
60706541436356f21d82a8ce0abcdb845b6e56ac2dfad7ffcee21111a371e2f941d5c0a7954d55d1024eee1078335c42aa4cdf3d42b8eb7bb684d5b2bcf1e424

Download Submit
C:\Users\Admin\AppData\Roaming\talkia\FontLookupTableCache\font_unique_name_table.pb

Filesize
124KB

MD5
d63f7887025e755069368ae80e72d7a3

SHA1
4473487230c9f86229a31f11d6e3f75fb3a918d0

SHA256
c0e1ad8c942a33165dd4e3b861c342d0691173678fc66b43db65ed1c2fc6785a

SHA512
74dc8a75b7ea23f2f4b1a5692b1ffd196433c3fdaa421cdbae68f5af7ef8d9f152cb4f4ab0a989633dd0809fc3fae6661425465226bb9c7fcc4445a2e1230843

Download Submit
C:\Users\Admin\AppData\Roaming\talkia\Local State

Filesize
389B

MD5
238ab48ca844ef7d514bcd5dbd6fb596

SHA1
add8dadb5b60a9dd23f763620ddf1e15f97f0705

SHA256
b5b7ac9b72da8f884001dbae4ab70aa86c949661bfedc9300b585fd85f70a678

SHA512
d4b64b1d690d32c706653672b283c6c03854480fb44287c49631997ba4aadbccc685e76fa42d9be87aeab611a9bc3f6e1b9a0bb607ad233e373d80637ce508d2

Download Submit
C:\Users\Admin\AppData\Roaming\talkia\Local Storage\leveldb\CURRENT~RFf776eba.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\talkia\Network\Network Persistent State

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\talkia\Preferences

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\talkia\Session Storage\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Roaming\talkia\a319da2b-ad87-418a-86c9-11c711a8fc72.tmp

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\talkia\en-US-10-1.bdic

Filesize
441KB

MD5
4604e676a0a7d18770853919e24ec465

SHA1
415ef3b2ca0851e00ebaf0d6c9f6213c561ac98f

SHA256
a075b01d9b015c616511a9e87da77da3d9881621db32f584e4606ddabf1c1100

SHA512
3d89c21f20772a8bebdb70b29c42fca2f6bffcda49dff9d5644f3f3910b7c710a5c20154a7af5134c9c7a8624a1251b5e56ced9351d87463f31bed8188eb0774

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\Talkia.exe

Filesize
144.8MB

MD5
e39b800468b4942021280d289f017443

SHA1
ef76d13df1834ad5fe85ad3466f732ce3b348bef

SHA256
b41b5f4564f707d57e72c2c2774f93cf0720d9c49ea953ac4c66db77b2b368aa

SHA512
2406d8b38ee9e16d5758b496a33d18ca05e5acfa3b8b470910a9871ac9e26913ea1b96df16a8df0650c0aac6996aeb2d21445a652855c91948499ab49fdfb432

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\d3dcompiler_47.dll

Filesize
4.7MB

MD5
cb9807f6cf55ad799e920b7e0f97df99

SHA1
bb76012ded5acd103adad49436612d073d159b29

SHA256
5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

SHA512
f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\d3dcompiler_47.dll

Filesize
4.7MB

MD5
cb9807f6cf55ad799e920b7e0f97df99

SHA1
bb76012ded5acd103adad49436612d073d159b29

SHA256
5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

SHA512
f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\d3dcompiler_47.dll

Filesize
4.7MB

MD5
cb9807f6cf55ad799e920b7e0f97df99

SHA1
bb76012ded5acd103adad49436612d073d159b29

SHA256
5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

SHA512
f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\ffmpeg.dll

Filesize
2.7MB

MD5
43c251b59c979399d6e9f5b643e5f2eb

SHA1
7f9ce5f18ea429bdf4088382efcd3ac1669e0326

SHA256
8cf2aea3a368a6bc90f1a2b07acf1518a42224d99836c0580db2a6031a3c8d40

SHA512
c77caf67c53d1b49ce0feeae1edad7b859144d3c78ae10a34073e424ac6e43c48f3e33e835162a6164d8c8ca036adbb0b3ff7929dd40e72819bbb18f176edc55

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\ffmpeg.dll

Filesize
2.7MB

MD5
43c251b59c979399d6e9f5b643e5f2eb

SHA1
7f9ce5f18ea429bdf4088382efcd3ac1669e0326

SHA256
8cf2aea3a368a6bc90f1a2b07acf1518a42224d99836c0580db2a6031a3c8d40

SHA512
c77caf67c53d1b49ce0feeae1edad7b859144d3c78ae10a34073e424ac6e43c48f3e33e835162a6164d8c8ca036adbb0b3ff7929dd40e72819bbb18f176edc55

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\ffmpeg.dll

Filesize
2.7MB

MD5
43c251b59c979399d6e9f5b643e5f2eb

SHA1
7f9ce5f18ea429bdf4088382efcd3ac1669e0326

SHA256
8cf2aea3a368a6bc90f1a2b07acf1518a42224d99836c0580db2a6031a3c8d40

SHA512
c77caf67c53d1b49ce0feeae1edad7b859144d3c78ae10a34073e424ac6e43c48f3e33e835162a6164d8c8ca036adbb0b3ff7929dd40e72819bbb18f176edc55

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\ffmpeg.dll

Filesize
2.7MB

MD5
43c251b59c979399d6e9f5b643e5f2eb

SHA1
7f9ce5f18ea429bdf4088382efcd3ac1669e0326

SHA256
8cf2aea3a368a6bc90f1a2b07acf1518a42224d99836c0580db2a6031a3c8d40

SHA512
c77caf67c53d1b49ce0feeae1edad7b859144d3c78ae10a34073e424ac6e43c48f3e33e835162a6164d8c8ca036adbb0b3ff7929dd40e72819bbb18f176edc55

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\ffmpeg.dll

Filesize
2.7MB

MD5
43c251b59c979399d6e9f5b643e5f2eb

SHA1
7f9ce5f18ea429bdf4088382efcd3ac1669e0326

SHA256
8cf2aea3a368a6bc90f1a2b07acf1518a42224d99836c0580db2a6031a3c8d40

SHA512
c77caf67c53d1b49ce0feeae1edad7b859144d3c78ae10a34073e424ac6e43c48f3e33e835162a6164d8c8ca036adbb0b3ff7929dd40e72819bbb18f176edc55

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\ffmpeg.dll

Filesize
2.7MB

MD5
43c251b59c979399d6e9f5b643e5f2eb

SHA1
7f9ce5f18ea429bdf4088382efcd3ac1669e0326

SHA256
8cf2aea3a368a6bc90f1a2b07acf1518a42224d99836c0580db2a6031a3c8d40

SHA512
c77caf67c53d1b49ce0feeae1edad7b859144d3c78ae10a34073e424ac6e43c48f3e33e835162a6164d8c8ca036adbb0b3ff7929dd40e72819bbb18f176edc55

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\ffmpeg.dll

Filesize
2.7MB

MD5
43c251b59c979399d6e9f5b643e5f2eb

SHA1
7f9ce5f18ea429bdf4088382efcd3ac1669e0326

SHA256
8cf2aea3a368a6bc90f1a2b07acf1518a42224d99836c0580db2a6031a3c8d40

SHA512
c77caf67c53d1b49ce0feeae1edad7b859144d3c78ae10a34073e424ac6e43c48f3e33e835162a6164d8c8ca036adbb0b3ff7929dd40e72819bbb18f176edc55

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\ffmpeg.dll

Filesize
2.7MB

MD5
43c251b59c979399d6e9f5b643e5f2eb

SHA1
7f9ce5f18ea429bdf4088382efcd3ac1669e0326

SHA256
8cf2aea3a368a6bc90f1a2b07acf1518a42224d99836c0580db2a6031a3c8d40

SHA512
c77caf67c53d1b49ce0feeae1edad7b859144d3c78ae10a34073e424ac6e43c48f3e33e835162a6164d8c8ca036adbb0b3ff7929dd40e72819bbb18f176edc55

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\ffmpeg.dll

Filesize
2.7MB

MD5
43c251b59c979399d6e9f5b643e5f2eb

SHA1
7f9ce5f18ea429bdf4088382efcd3ac1669e0326

SHA256
8cf2aea3a368a6bc90f1a2b07acf1518a42224d99836c0580db2a6031a3c8d40

SHA512
c77caf67c53d1b49ce0feeae1edad7b859144d3c78ae10a34073e424ac6e43c48f3e33e835162a6164d8c8ca036adbb0b3ff7929dd40e72819bbb18f176edc55

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\libEGL.dll

Filesize
458KB

MD5
a2f50aa2de05f7765208db45c0fac2a6

SHA1
a358dbbaae33f23ca6877f9902fc71b3aacfd8de

SHA256
c1ec4d974dcc8638287e028d01d56213e47eb0632742ea696c6ca518a750bf04

SHA512
223e8f34f07792ab1691bb7cedb29137a85c8cd7c07ad5d6d6131ad042e98d843117c56cb1e0c3165201f29650fe6f96ed72946b9db57b1d2986a525aca3e778

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\libEGL.dll

Filesize
458KB

MD5
a2f50aa2de05f7765208db45c0fac2a6

SHA1
a358dbbaae33f23ca6877f9902fc71b3aacfd8de

SHA256
c1ec4d974dcc8638287e028d01d56213e47eb0632742ea696c6ca518a750bf04

SHA512
223e8f34f07792ab1691bb7cedb29137a85c8cd7c07ad5d6d6131ad042e98d843117c56cb1e0c3165201f29650fe6f96ed72946b9db57b1d2986a525aca3e778

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\libGLESv2.dll

Filesize
7.1MB

MD5
6c7d96f2c9b611e1a6d4a234360f4652

SHA1
f1a1e7ff9d20184316c5bf4386918b3149b01c59

SHA256
7d2a9cfa2ba7dfd17a4be7d573b66ce19ca5ee7e55ed737db60ecfc4d2413ca5

SHA512
99850f64f41c2accbdc0c1e6ebbf987842f51a5bcc4b600a5a351f7fb7be13bb12381c33bf9f0c095ad59c0f0a8f1cc21f63bd45e535e69015a97b777c2e2661

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\libGLESv2.dll

Filesize
7.1MB

MD5
6c7d96f2c9b611e1a6d4a234360f4652

SHA1
f1a1e7ff9d20184316c5bf4386918b3149b01c59

SHA256
7d2a9cfa2ba7dfd17a4be7d573b66ce19ca5ee7e55ed737db60ecfc4d2413ca5

SHA512
99850f64f41c2accbdc0c1e6ebbf987842f51a5bcc4b600a5a351f7fb7be13bb12381c33bf9f0c095ad59c0f0a8f1cc21f63bd45e535e69015a97b777c2e2661

Download Submit
\Users\Admin\AppData\Local\Programs\talkia\libGLESv2.dll

Filesize
7.1MB

MD5
6c7d96f2c9b611e1a6d4a234360f4652

SHA1
f1a1e7ff9d20184316c5bf4386918b3149b01c59

SHA256
7d2a9cfa2ba7dfd17a4be7d573b66ce19ca5ee7e55ed737db60ecfc4d2413ca5

SHA512
99850f64f41c2accbdc0c1e6ebbf987842f51a5bcc4b600a5a351f7fb7be13bb12381c33bf9f0c095ad59c0f0a8f1cc21f63bd45e535e69015a97b777c2e2661

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBECE.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
memory/1056-1204-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/1892-1258-0x0000000077870000-0x0000000077871000-memory.dmp

Filesize
4KB

Download
memory/2016-1208-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/2040-1145-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/2280-875-0x0000000003AD0000-0x0000000003AD2000-memory.dmp

Filesize
8KB

Download