0a5cf3d18ed7598484b486058e5ea622c11f42c699360781e28a6889a6b52ce3

Analysis

max time kernel
899s
max time network
633s
platform
windows10-2004_x64
resource
win10v2004-20260513-de
resource tags

arch:x64arch:x86image:win10v2004-20260513-delocale:de-deos:windows10-2004-x64systemwindows
submitted
20/07/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Notoq Game Center.exe
Size 221.5MB
Sample260720-xd4pmab13q
SHA256 0a5cf3d18ed7598484b486058e5ea622c11f42c699360781e28a6889a6b52ce3
MD5 a80d0b7cfece4bf3b69c40af684d46ea
SHA1 fd874e3d11de89acf34190d5a6f855d119e5c415
SHA512 574ddcbcb25b6f5d203d2bad533e7bfde0c3e08466d898c17f6264c8acc4a09f3955e20b5944ef05193e74ac53d62a612ae7a08105eb18c0d86e493025b2b207
SSDEEP 1572864:86s3R+1OrrQQrHzz/HNBnhOuKb3aynBZS+OdF9/f1FlKVROhJA0lf9MQyRUHuJTQ:jn1Ofrv5GttDl66w/
TLSH
T11AB88B03F29A41E9C01DC1799B5B9633FE71B8454B24A7DF2B5407922F66EE82B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	Notoq Game Center.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	Notoq Game Center.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	Notoq Game Center.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	Notoq Game Center.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Notoq Game Center = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Notoq Game Center.exe\" --hidden"	Notoq Game Center.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Notoq Game Center = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Notoq Game Center.exe\" --hidden"	Notoq Game Center.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3784	powershell.exe
1396	powershell.exe
3860	powershell.exe
2092	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1396	powershell.exe
3784	powershell.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Notoq Game Center.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Notoq Game Center.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Notoq Game Center.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Notoq Game Center.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Notoq Game Center.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Notoq Game Center.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Notoq Game Center.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Notoq Game Center.exe

Modifies registry key 1 TTPs 26 IoCs

Modify Registry

T1112

pid	Process
2964	reg.exe
2100	reg.exe
2236	reg.exe
4992	reg.exe
4692	reg.exe
1616	reg.exe
4184	reg.exe
1940	reg.exe
3892	reg.exe
2852	reg.exe
1028	reg.exe
3704	reg.exe
4900	reg.exe
3908	reg.exe
3048	reg.exe
4040	reg.exe
2064	reg.exe
1620	reg.exe
720	reg.exe
5008	reg.exe
4776	reg.exe
3312	reg.exe
1460	reg.exe
4260	reg.exe
3556	reg.exe
4036	reg.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1396	powershell.exe
1396	powershell.exe
3860	powershell.exe
3860	powershell.exe
2092	powershell.exe
2092	powershell.exe
1396	powershell.exe
3784	powershell.exe
3784	powershell.exe
3784	powershell.exe
3572	Notoq Game Center.exe
3572	Notoq Game Center.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	1336	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	1336	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	1336	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	1336	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	1336	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	1336	Notoq Game Center.exe
Token: SeDebugPrivilege	3784	powershell.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe
Token: SeShutdownPrivilege	1336	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	1336	Notoq Game Center.exe
Token: SeShutdownPrivilege	4416	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4416	Notoq Game Center.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
1336	Notoq Game Center.exe
1336	Notoq Game Center.exe
1336	Notoq Game Center.exe
1336	Notoq Game Center.exe
1336	Notoq Game Center.exe
1336	Notoq Game Center.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
4416	Notoq Game Center.exe
1336	Notoq Game Center.exe
1336	Notoq Game Center.exe
1336	Notoq Game Center.exe
1336	Notoq Game Center.exe
1336	Notoq Game Center.exe
1336	Notoq Game Center.exe
1336	Notoq Game Center.exe
1336	Notoq Game Center.exe
1336	Notoq Game Center.exe
1336	Notoq Game Center.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 1972	4416	Notoq Game Center.exe	81
PID 4416 wrote to memory of 4448	4416	Notoq Game Center.exe	82
PID 4416 wrote to memory of 2900	4416	Notoq Game Center.exe	83
PID 4416 wrote to memory of 2092	4416	Notoq Game Center.exe	84
PID 4416 wrote to memory of 3860	4416	Notoq Game Center.exe	85
PID 4416 wrote to memory of 4184	4416	Notoq Game Center.exe	86
PID 4416 wrote to memory of 2064	4416	Notoq Game Center.exe	87
PID 4416 wrote to memory of 1396	4416	Notoq Game Center.exe	88
PID 4416 wrote to memory of 1616	4416	Notoq Game Center.exe	89
PID 4416 wrote to memory of 4692	4416	Notoq Game Center.exe	90
PID 4416 wrote to memory of 2204	4416	Notoq Game Center.exe	91
PID 4416 wrote to memory of 4040	4416	Notoq Game Center.exe	152
PID 4416 wrote to memory of 1460	4416	Notoq Game Center.exe	93
PID 4416 wrote to memory of 2500	4416	Notoq Game Center.exe	105
PID 4416 wrote to memory of 3556	4416	Notoq Game Center.exe	106
PID 4416 wrote to memory of 4260	4416	Notoq Game Center.exe	107
PID 4416 wrote to memory of 3704	4416	Notoq Game Center.exe	108
PID 4416 wrote to memory of 1940	4416	Notoq Game Center.exe	156
PID 4416 wrote to memory of 2160	4416	Notoq Game Center.exe	116
PID 4416 wrote to memory of 2880	4416	Notoq Game Center.exe	118
PID 4416 wrote to memory of 1932	4416	Notoq Game Center.exe	119
PID 4416 wrote to memory of 720	4416	Notoq Game Center.exe	124
PID 4416 wrote to memory of 3784	4416	Notoq Game Center.exe	125
PID 4416 wrote to memory of 2100	4416	Notoq Game Center.exe	173
PID 4416 wrote to memory of 3892	4416	Notoq Game Center.exe	127
PID 4416 wrote to memory of 2028	4416	Notoq Game Center.exe	128
PID 4416 wrote to memory of 3908	4416	Notoq Game Center.exe	244
PID 4416 wrote to memory of 4036	4416	Notoq Game Center.exe	184
PID 1336 wrote to memory of 4676	1336	Notoq Game Center.exe	139
PID 1336 wrote to memory of 4896	1336	Notoq Game Center.exe	138
PID 1336 wrote to memory of 4108	1336	Notoq Game Center.exe	140
PID 4416 wrote to memory of 4900	4416	Notoq Game Center.exe	142
PID 4416 wrote to memory of 1620	4416	Notoq Game Center.exe	143
PID 4416 wrote to memory of 2964	4416	Notoq Game Center.exe	144
PID 4416 wrote to memory of 2608	4416	Notoq Game Center.exe	191
PID 4416 wrote to memory of 3964	4416	Notoq Game Center.exe	241
PID 4416 wrote to memory of 2196	4416	Notoq Game Center.exe	147
PID 4416 wrote to memory of 4264	4416	Notoq Game Center.exe	148
PID 4416 wrote to memory of 1940	4416	Notoq Game Center.exe	156
PID 4416 wrote to memory of 396	4416	Notoq Game Center.exe	204
PID 4416 wrote to memory of 2568	4416	Notoq Game Center.exe	158
PID 4416 wrote to memory of 3832	4416	Notoq Game Center.exe	261
PID 4416 wrote to memory of 1256	4416	Notoq Game Center.exe	160
PID 4416 wrote to memory of 4172	4416	Notoq Game Center.exe	272
PID 4416 wrote to memory of 4308	4416	Notoq Game Center.exe	167
PID 4416 wrote to memory of 2180	4416	Notoq Game Center.exe	170
PID 4416 wrote to memory of 3904	4416	Notoq Game Center.exe	172
PID 4416 wrote to memory of 3960	4416	Notoq Game Center.exe	174
PID 4416 wrote to memory of 3388	4416	Notoq Game Center.exe	176
PID 4416 wrote to memory of 4924	4416	Notoq Game Center.exe	282
PID 4416 wrote to memory of 4912	4416	Notoq Game Center.exe	180
PID 4416 wrote to memory of 1436	4416	Notoq Game Center.exe	182
PID 4416 wrote to memory of 2280	4416	Notoq Game Center.exe	183
PID 4416 wrote to memory of 1032	4416	Notoq Game Center.exe	186
PID 4416 wrote to memory of 4248	4416	Notoq Game Center.exe	247
PID 4416 wrote to memory of 3444	4416	Notoq Game Center.exe	190
PID 4416 wrote to memory of 1196	4416	Notoq Game Center.exe	192
PID 4416 wrote to memory of 4344	4416	Notoq Game Center.exe	251
PID 4416 wrote to memory of 4820	4416	Notoq Game Center.exe	196
PID 4416 wrote to memory of 1816	4416	Notoq Game Center.exe	198
PID 4416 wrote to memory of 1460	4416	Notoq Game Center.exe	200
PID 4416 wrote to memory of 1680	4416	Notoq Game Center.exe	201
PID 4416 wrote to memory of 396	4416	Notoq Game Center.exe	204
PID 4416 wrote to memory of 3248	4416	Notoq Game Center.exe	206

C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe
"C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe
  "C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\@notoq/desktop" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1764,i,6757331474897802337,2031726378658086922,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1768,i,16955834495426436433,12181057169954926878,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1760 /prefetch:2
  2⤵
  PID:1972
- C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe
  "C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\@notoq/desktop" --field-trial-handle=1764,i,6757331474897802337,2031726378658086922,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1768,i,16955834495426436433,12181057169954926878,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1812 /prefetch:3
  2⤵
  PID:4448
- C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe
  "C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\@notoq/desktop" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1764,i,6757331474897802337,2031726378658086922,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1768,i,16955834495426436433,12181057169954926878,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2528 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\gc-bt-4416-1784573491489-t19141ikn7.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\gc-bt-4416-1784573491493-rj1sy999k9.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3860
- C:\Windows\system32\reg.exe
  reg query HKCU\Software\Valve\Steam /v SteamPath
  2⤵
  - Modifies registry key
  PID:4184
- C:\Windows\system32\reg.exe
  reg query HKCU\Software\Valve\Steam /v SteamPath
  2⤵
  - Modifies registry key
  PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference='SilentlyContinue' $pkgKey='HKLM:\SOFTWARE\Microsoft\GamingServices\PackageRepository\Package' $rootKey='HKLM:\SOFTWARE\Microsoft\GamingServices\PackageRepository\Root' $fams=New-Object System.Collections.Generic.HashSet[string] function AddFam($s){ if($s){ [void]$fams.Add($s.ToLower()) } } if(Test-Path $pkgKey){ foreach($vn in (Get-Item $pkgKey).GetValueNames()){ if($vn -like '*__*'){ $parts=$vn -split '__' $name=($parts[0] -split '_')[0] AddFam(\"$($name)_$($parts[1])\") } } } if(Test-Path $rootKey){ foreach($k in (Get-ChildItem $rootKey)){ $n=$k.PSChildName if($n -and ($n -notlike '{*')){ AddFam $n } } } if($fams.Count -eq 0){ '[]' } else { $start=@{} foreach($a in (Get-StartApps)){ if($a.AppID -match '!'){ $pfn=$a.AppID.Substring(0,$a.AppID.IndexOf('!')) if(-not $start.ContainsKey($pfn.ToLower())){ $start[$pfn.ToLower()]=@{ Name=$a.Name; Aumid=$a.AppID } } } } $result=foreach($p in (Get-AppxPackage)){ if(-not $p.InstallLocation){ continue } if(-not $fams.Contains($p.PackageFamilyName.ToLower())){ continue } $appId=$null;$logo=$null;$dn=$null;$bg=$null;$xml=$null $manifest=Join-Path $p.InstallLocation 'AppxManifest.xml' if(Test-Path $manifest){ try{ [xml]$xml=Get-Content -LiteralPath $manifest -Raw -Encoding UTF8 }catch{} } if($xml){ $app=@($xml.Package.Applications.Application)[0] if($app){ $appId=$app.Id $vis=$app.VisualElements $dn=$vis.DisplayName $bg=$vis.BackgroundColor $logoRel=$vis.Square150x150Logo; if(-not $logoRel){ $logoRel=$vis.Logo } if($logoRel){ $full=Join-Path $p.InstallLocation $logoRel $d=Split-Path $full; $fn=[IO.Path]::GetFileNameWithoutExtension($full); $ext=[IO.Path]::GetExtension($full) $cand=Get-ChildItem -LiteralPath $d -Filter ($fn+'*'+$ext) -ErrorAction SilentlyContinue | Sort-Object Length -Descending | Select-Object -First 1 if($cand){ $logo=$cand.FullName } elseif(Test-Path $full){ $logo=$full } } } } $s=$start[$p.PackageFamilyName.ToLower()] $aumid=$null if($s){ $dn=$s.Name; $aumid=$s.Aumid } if((-not $dn) -or ($dn -like 'ms-resource:*')){ $dn=$p.Name } if((-not $aumid) -and $appId){ $aumid=\"$($p.PackageFamilyName)!$($appId)\" } [PSCustomObject]@{ Name=$p.Name; Pfn=$p.PackageFamilyName; Dir=$p.InstallLocation; Aumid=$aumid; DisplayName=$dn; Logo=$logo; Bg=$bg } } @($result) | ConvertTo-Json -Depth 4 } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1396
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\GOG.com\Games
  2⤵
  - Modifies registry key
  PID:1616
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Ubisoft\Launcher\Installs
  2⤵
  - Modifies registry key
  PID:4692
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Origin Games"
  2⤵
  PID:2204
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:4040
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:1460
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Origin Games"
  2⤵
  PID:2500
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Ubisoft\Launcher\Installs
  2⤵
  - Modifies registry key
  PID:3556
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Valve\Steam /v InstallPath
  2⤵
  - Modifies registry key
  PID:4260
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\GOG.com\Games
  2⤵
  - Modifies registry key
  PID:3704
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Valve\Steam /v InstallPath
  2⤵
  - Modifies registry key
  PID:1940
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
  2⤵
  PID:2160
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\EA Games"
  2⤵
  PID:2880
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
  2⤵
  PID:1932
- C:\Windows\system32\reg.exe
  reg query HKCU\Software\Valve\Steam /v SteamPath
  2⤵
  - Modifies registry key
  PID:720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference='SilentlyContinue' $pkgKey='HKLM:\SOFTWARE\Microsoft\GamingServices\PackageRepository\Package' $rootKey='HKLM:\SOFTWARE\Microsoft\GamingServices\PackageRepository\Root' $fams=New-Object System.Collections.Generic.HashSet[string] function AddFam($s){ if($s){ [void]$fams.Add($s.ToLower()) } } if(Test-Path $pkgKey){ foreach($vn in (Get-Item $pkgKey).GetValueNames()){ if($vn -like '*__*'){ $parts=$vn -split '__' $name=($parts[0] -split '_')[0] AddFam(\"$($name)_$($parts[1])\") } } } if(Test-Path $rootKey){ foreach($k in (Get-ChildItem $rootKey)){ $n=$k.PSChildName if($n -and ($n -notlike '{*')){ AddFam $n } } } if($fams.Count -eq 0){ '[]' } else { $start=@{} foreach($a in (Get-StartApps)){ if($a.AppID -match '!'){ $pfn=$a.AppID.Substring(0,$a.AppID.IndexOf('!')) if(-not $start.ContainsKey($pfn.ToLower())){ $start[$pfn.ToLower()]=@{ Name=$a.Name; Aumid=$a.AppID } } } } $result=foreach($p in (Get-AppxPackage)){ if(-not $p.InstallLocation){ continue } if(-not $fams.Contains($p.PackageFamilyName.ToLower())){ continue } $appId=$null;$logo=$null;$dn=$null;$bg=$null;$xml=$null $manifest=Join-Path $p.InstallLocation 'AppxManifest.xml' if(Test-Path $manifest){ try{ [xml]$xml=Get-Content -LiteralPath $manifest -Raw -Encoding UTF8 }catch{} } if($xml){ $app=@($xml.Package.Applications.Application)[0] if($app){ $appId=$app.Id $vis=$app.VisualElements $dn=$vis.DisplayName $bg=$vis.BackgroundColor $logoRel=$vis.Square150x150Logo; if(-not $logoRel){ $logoRel=$vis.Logo } if($logoRel){ $full=Join-Path $p.InstallLocation $logoRel $d=Split-Path $full; $fn=[IO.Path]::GetFileNameWithoutExtension($full); $ext=[IO.Path]::GetExtension($full) $cand=Get-ChildItem -LiteralPath $d -Filter ($fn+'*'+$ext) -ErrorAction SilentlyContinue | Sort-Object Length -Descending | Select-Object -First 1 if($cand){ $logo=$cand.FullName } elseif(Test-Path $full){ $logo=$full } } } } $s=$start[$p.PackageFamilyName.ToLower()] $aumid=$null if($s){ $dn=$s.Name; $aumid=$s.Aumid } if((-not $dn) -or ($dn -like 'ms-resource:*')){ $dn=$p.Name } if((-not $aumid) -and $appId){ $aumid=\"$($p.PackageFamilyName)!$($appId)\" } [PSCustomObject]@{ Name=$p.Name; Pfn=$p.PackageFamilyName; Dir=$p.InstallLocation; Aumid=$aumid; DisplayName=$dn; Logo=$logo; Bg=$bg } } @($result) | ConvertTo-Json -Depth 4 } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3784
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\GOG.com\Games
  2⤵
  - Modifies registry key
  PID:2100
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Ubisoft\Launcher\Installs
  2⤵
  - Modifies registry key
  PID:3892
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Origin Games"
  2⤵
  PID:2028
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:3908
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:4036
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Valve\Steam /v InstallPath
  2⤵
  - Modifies registry key
  PID:4900
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\GOG.com\Games
  2⤵
  - Modifies registry key
  PID:1620
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Ubisoft\Launcher\Installs
  2⤵
  - Modifies registry key
  PID:2964
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Origin Games"
  2⤵
  PID:2608
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4040
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\EA Games"
  2⤵
  PID:3964
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
  2⤵
  PID:2196
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
  2⤵
  PID:4264
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
  2⤵
  PID:1940
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
  2⤵
  PID:396
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
  2⤵
  PID:2568
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
  2⤵
  PID:3832
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\EA Games"
  2⤵
  PID:1256
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
  2⤵
  PID:4172
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
  2⤵
  PID:2180
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\EA Games"
  2⤵
  PID:3904
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2100
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
  2⤵
  PID:3960
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime
  2⤵
  PID:3388
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
  2⤵
  PID:4924
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
  2⤵
  PID:4912
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
  2⤵
  PID:1436
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4036
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
  2⤵
  PID:2280
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
  2⤵
  PID:1032
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime
  2⤵
  PID:4248
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
  2⤵
  PID:3444
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2608
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime
  2⤵
  PID:1196
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime
  2⤵
  PID:4344
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
  2⤵
  PID:4820
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
  2⤵
  PID:1816
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
  2⤵
  PID:1460
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
  2⤵
  PID:1680
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
  2⤵
  PID:396
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
  2⤵
  PID:3248
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
  2⤵
  PID:4380
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
  2⤵
  PID:4832
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
  2⤵
  PID:2380
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
  2⤵
  PID:4172
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
  2⤵
  PID:4928
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
  2⤵
  PID:2036
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
  2⤵
  PID:4952
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
  2⤵
  PID:2752
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
  2⤵
  PID:4616
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
  2⤵
  PID:3304
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
  2⤵
  PID:1904
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
  2⤵
  PID:1448
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 135.0 (x64 en-US)"
  2⤵
  PID:4348
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
  2⤵
  PID:3676
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
  2⤵
  PID:4260
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
  2⤵
  PID:4612
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService
  2⤵
  PID:4464
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3964
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 135.0 (x64 en-US)"
  2⤵
  PID:3908
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 135.0 (x64 en-US)"
  2⤵
  PID:2108
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4248
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2
  2⤵
  PID:4908
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 135.0 (x64 en-US)"
  2⤵
  PID:2984
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4344
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService
  2⤵
  PID:1608
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService
  2⤵
  PID:3104
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"
  2⤵
  PID:2460
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService
  2⤵
  PID:2068
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2
  2⤵
  PID:448
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3832
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
  2⤵
  PID:1076
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"
  2⤵
  PID:4192
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4380
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"
  2⤵
  PID:4960
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2
  2⤵
  PID:2360
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2
  2⤵
  PID:1132
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"
  2⤵
  PID:4172
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"
  2⤵
  PID:4132
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
  2⤵
  PID:2056
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
  2⤵
  PID:1600
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"
  2⤵
  PID:4684
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"
  2⤵
  PID:4924
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
  2⤵
  PID:2948
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"
  2⤵
  PID:2392
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
  2⤵
  PID:3780
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}
  2⤵
  PID:3800
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}
  2⤵
  PID:4040
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}
  2⤵
  PID:4388
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}
  2⤵
  PID:4992
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}
  2⤵
  PID:3864
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}
  2⤵
  PID:560
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}
  2⤵
  PID:3784
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}
  2⤵
  PID:4836
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}
  2⤵
  PID:4552
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}
  2⤵
  PID:3648
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}
  2⤵
  PID:4588
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}
  2⤵
  PID:3268
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
  2⤵
  PID:3312
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}
  2⤵
  PID:3540
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
  2⤵
  PID:4928
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}
  2⤵
  PID:1428
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}
  2⤵
  PID:4952
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}
  2⤵
  PID:4996
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}
  2⤵
  PID:4328
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}
  2⤵
  PID:4364
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}
  2⤵
  PID:4676
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}
  2⤵
  PID:3436
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}
  2⤵
  PID:860
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
  2⤵
  PID:3808
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}
  2⤵
  PID:2880
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}
  2⤵
  PID:4612
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}
  2⤵
  PID:1444
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}
  2⤵
  PID:3964
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}
  2⤵
  PID:3908
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}
  2⤵
  PID:2108
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}
  2⤵
  PID:1196
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}
  2⤵
  PID:2984
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}
  2⤵
  PID:3104
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}
  2⤵
  PID:4836
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}
  2⤵
  PID:2160
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}
  2⤵
  PID:2176
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}
  2⤵
  PID:2112
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}
  2⤵
  PID:2316
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}
  2⤵
  PID:4684
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}
  2⤵
  PID:4592
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}
  2⤵
  PID:3892
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}
  2⤵
  PID:2448
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}
  2⤵
  PID:3792
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}
  2⤵
  PID:4776
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}
  2⤵
  PID:2992
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}
  2⤵
  PID:4676
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}
  2⤵
  PID:3436
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}
  2⤵
  PID:4924
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}
  2⤵
  PID:3304
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}
  2⤵
  PID:860
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}
  2⤵
  PID:3780
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}
  2⤵
  PID:824
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}
  2⤵
  PID:5024
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}
  2⤵
  PID:4388
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}
  2⤵
  PID:3964
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}
  2⤵
  PID:3908
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}
  2⤵
  PID:2108
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}
  2⤵
  PID:1196
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}
  2⤵
  PID:2984
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}
  2⤵
  PID:3104
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:2852
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}
  2⤵
  PID:2700
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}
  2⤵
  PID:4892
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}
  2⤵
  PID:4196
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}
  2⤵
  PID:4576
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}
  2⤵
  PID:2400
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}
  2⤵
  PID:1428
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}
  2⤵
  PID:2960
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}
  2⤵
  PID:4920
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}
  2⤵
  PID:1256
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}
  2⤵
  PID:1040
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:5008
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}
  2⤵
  PID:1940
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
  2⤵
  PID:3048
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}
  2⤵
  PID:732
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
  2⤵
  PID:4960
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}
  2⤵
  PID:1420
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
  2⤵
  PID:4976
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}
  2⤵
  PID:196
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
  2⤵
  PID:4208
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime
  2⤵
  PID:1032
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
  2⤵
  PID:2500
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
  2⤵
  PID:4436
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome"
  2⤵
  PID:2432
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime
  2⤵
  PID:2616
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40
  2⤵
  PID:2772
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
  2⤵
  PID:1460
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
  2⤵
  PID:952
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome"
  2⤵
  PID:2164
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
  2⤵
  PID:2856
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40
  2⤵
  PID:4592
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData
  2⤵
  PID:3456
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}
  2⤵
  PID:2036
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
  2⤵
  PID:4472
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update"
  2⤵
  PID:1636
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}
  2⤵
  PID:2788
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
  2⤵
  PID:4704
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft EdgeWebView"
  2⤵
  PID:5036
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}
  2⤵
  PID:4264
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData
  2⤵
  PID:2572
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
  2⤵
  PID:4924
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}
  2⤵
  PID:2692
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update"
  2⤵
  PID:1580
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2
  2⤵
  PID:4960
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}
  2⤵
  PID:112
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft EdgeWebView"
  2⤵
  PID:2132
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
  2⤵
  PID:1760
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}
  2⤵
  PID:4040
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
  2⤵
  PID:3860
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2
  2⤵
  PID:1064
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757
  2⤵
  PID:1836
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
  2⤵
  PID:3384
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173
  2⤵
  PID:3968
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC
  2⤵
  PID:2700
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860
  2⤵
  PID:756
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757
  2⤵
  PID:3576
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173
  2⤵
  PID:3648
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743
  2⤵
  PID:2796
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860
  2⤵
  PID:2100
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063
  2⤵
  PID:3960
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655
  2⤵
  PID:4132
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573
  2⤵
  PID:3728
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743
  2⤵
  PID:4676
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}
  2⤵
  PID:4748
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063
  2⤵
  PID:788
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
  2⤵
  PID:1268
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e}
  2⤵
  PID:2776
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5625bb48-295c-4113-bc92-d6a69b19b04c}
  2⤵
  PID:4092
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573
  2⤵
  PID:3632
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}
  2⤵
  PID:3428
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}
  2⤵
  PID:4048
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36}
  2⤵
  PID:1608
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
  2⤵
  PID:4648
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{79D068F5-40E4-3614-A683-E351DF40BEBD}
  2⤵
  PID:4588
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e}
  2⤵
  PID:1032
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7}
  2⤵
  PID:2888
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5625bb48-295c-4113-bc92-d6a69b19b04c}
  2⤵
  PID:2968
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F}
  2⤵
  PID:1196
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}
  2⤵
  PID:2104
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}
  2⤵
  PID:4396
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36}
  2⤵
  PID:2176
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9}
  2⤵
  PID:2600
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{79D068F5-40E4-3614-A683-E351DF40BEBD}
  2⤵
  PID:2360
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}
  2⤵
  PID:4680
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4}
  2⤵
  PID:4164
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}
  2⤵
  PID:2180
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d87ae0f4-64a6-4b94-859a-530b9c313c27}
  2⤵
  PID:3456
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}
  2⤵
  PID:4120
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}
  2⤵
  PID:1600
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}
  2⤵
  PID:4952
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}
  2⤵
  PID:2788
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}
  2⤵
  PID:4676
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}
  2⤵
  PID:4348
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}
  2⤵
  PID:4420
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}
  2⤵
  PID:2136
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}
  2⤵
  PID:4924
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}
  2⤵
  PID:204
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}
  2⤵
  PID:416
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}
  2⤵
  PID:2068
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}
  2⤵
  PID:3268
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}
  2⤵
  PID:2132
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}
  2⤵
  PID:3964
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}
  2⤵
  PID:3700
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}
  2⤵
  PID:3864
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}
  2⤵
  PID:2888
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}
  2⤵
  PID:4564
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}
  2⤵
  PID:2608
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}
  2⤵
  PID:1684
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:2236
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
  2⤵
  PID:2392
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
  2⤵
  PID:4196
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
  2⤵
  PID:2160
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime
  2⤵
  PID:3432
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
  2⤵
  PID:2916
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome"
  2⤵
  PID:4984
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40
  2⤵
  PID:4472
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
  2⤵
  PID:3588
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
  2⤵
  PID:2456
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData
  2⤵
  PID:1656
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update"
  2⤵
  PID:3544
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft EdgeWebView"
  2⤵
  PID:2752
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
  2⤵
  PID:32
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7}
  2⤵
  PID:4264
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2
  2⤵
  PID:4212
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F}
  2⤵
  PID:2992
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
  2⤵
  PID:4832
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}
  2⤵
  PID:1624
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC
  2⤵
  PID:4760
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9}
  2⤵
  PID:732
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757
  2⤵
  PID:4880
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}
  2⤵
  PID:3736
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173
  2⤵
  PID:2132
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4}
  2⤵
  PID:3220
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef5af41f-d68c-48f7-bfb0-5055718601fc}
  2⤵
  PID:3608
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}
  2⤵
  PID:3856
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d87ae0f4-64a6-4b94-859a-530b9c313c27}
  2⤵
  PID:3080
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860
  2⤵
  PID:1164
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}
  2⤵
  PID:5084
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655
  2⤵
  PID:2600
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef5af41f-d68c-48f7-bfb0-5055718601fc}
  2⤵
  PID:4680
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743
  2⤵
  PID:3756
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}
  2⤵
  PID:2180
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063
  2⤵
  PID:3456
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}
  2⤵
  PID:3248
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573
  2⤵
  PID:1896
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757
  2⤵
  PID:512
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}
  2⤵
  PID:4508
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173
  2⤵
  PID:4380
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860
  2⤵
  PID:1884
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655
  2⤵
  PID:4896
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743
  2⤵
  PID:516
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063
  2⤵
  PID:1268
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573
  2⤵
  PID:2956
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}
  2⤵
  PID:788
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:3048
- C:\Windows\system32\reg.exe
  reg query HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe
  2⤵
  PID:2820
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}
  2⤵
  PID:1784
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}
  2⤵
  PID:2612
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}
  2⤵
  PID:3800
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:1028
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
  2⤵
  PID:4932
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
  2⤵
  PID:1444
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
  2⤵
  PID:4344
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime
  2⤵
  PID:2724
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
  2⤵
  PID:3784
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome"
  2⤵
  PID:2432
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40
  2⤵
  PID:112
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
  2⤵
  PID:4396
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
  2⤵
  PID:448
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData
  2⤵
  PID:4836
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update"
  2⤵
  PID:2700
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft EdgeWebView"
  2⤵
  PID:2060
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
  2⤵
  PID:3892
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2
  2⤵
  PID:3648
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
  2⤵
  PID:4592
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC
  2⤵
  PID:3248
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757
  2⤵
  PID:2972
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173
  2⤵
  PID:4952
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860
  2⤵
  PID:3388
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655
  2⤵
  PID:3544
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743
  2⤵
  PID:4104
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063
  2⤵
  PID:756
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573
  2⤵
  PID:1940
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}
  2⤵
  PID:2064
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
  2⤵
  PID:1808
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e}
  2⤵
  PID:4264
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5625bb48-295c-4113-bc92-d6a69b19b04c}
  2⤵
  PID:4924
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}
  2⤵
  PID:4116
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}
  2⤵
  PID:2384
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36}
  2⤵
  PID:416
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}
  2⤵
  PID:2656
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{79D068F5-40E4-3614-A683-E351DF40BEBD}
  2⤵
  PID:4976
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757
  2⤵
  PID:4568
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7}
  2⤵
  PID:2960
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
  2⤵
  PID:1932
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F}
  2⤵
  PID:3700
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}
  2⤵
  PID:3908
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9}
  2⤵
  PID:4740
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173
  2⤵
  PID:4620
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}
  2⤵
  PID:4136
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4}
  2⤵
  PID:448
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860
  2⤵
  PID:1188
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}
  2⤵
  PID:2312
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d87ae0f4-64a6-4b94-859a-530b9c313c27}
  2⤵
  PID:5116
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}
  2⤵
  PID:3432
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef5af41f-d68c-48f7-bfb0-5055718601fc}
  2⤵
  PID:3648
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}
  2⤵
  PID:4592
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655
  2⤵
  PID:2932
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743
  2⤵
  PID:3588
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063
  2⤵
  PID:2092
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573
  2⤵
  PID:4132
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}
  2⤵
  PID:3544
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:4776
- C:\Windows\system32\reg.exe
  reg query HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe
  2⤵
  PID:2572
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}
  2⤵
  PID:4348
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757
  2⤵
  PID:4060
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173
  2⤵
  PID:3732
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860
  2⤵
  PID:3632
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655
  2⤵
  PID:2692
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743
  2⤵
  PID:5108
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063
  2⤵
  PID:4048
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573
  2⤵
  PID:4336
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}
  2⤵
  PID:3800
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:3312
- C:\Windows\system32\reg.exe
  reg query HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe
  2⤵
  PID:1028
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e}
  2⤵
  PID:2292
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5625bb48-295c-4113-bc92-d6a69b19b04c}
  2⤵
  PID:3220
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}
  2⤵
  PID:2968
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36}
  2⤵
  PID:3908
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{79D068F5-40E4-3614-A683-E351DF40BEBD}
  2⤵
  PID:4568
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7}
  2⤵
  PID:4384
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F}
  2⤵
  PID:3104
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}
  2⤵
  PID:5084
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9}
  2⤵
  PID:4948
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}
  2⤵
  PID:1132
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4}
  2⤵
  PID:2856
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}
  2⤵
  PID:4680
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d87ae0f4-64a6-4b94-859a-530b9c313c27}
  2⤵
  PID:3248
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}
  2⤵
  PID:4952
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef5af41f-d68c-48f7-bfb0-5055718601fc}
  2⤵
  PID:3388
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}
  2⤵
  PID:1812
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}
  2⤵
  PID:516
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757
  2⤵
  PID:3824
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173
  2⤵
  PID:4592
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860
  2⤵
  PID:4988
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655
  2⤵
  PID:1808
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743
  2⤵
  PID:4720
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063
  2⤵
  PID:1496
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573
  2⤵
  PID:2384
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}
  2⤵
  PID:732
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:4992
- C:\Windows\system32\reg.exe
  reg query HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe
  2⤵
  PID:4236
- C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe
  "C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\@notoq/desktop" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1764,i,6757331474897802337,2031726378658086922,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1768,i,16955834495426436433,12181057169954926878,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572

C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe
"C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe" --hidden
1⤵
- Checks computer location settings
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe
  "C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\@notoq/desktop" --field-trial-handle=1820,i,4324046335799933183,638121885032452658,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1824,i,17393935183204866861,6758751285817654543,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  PID:4896
- C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe
  "C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\@notoq/desktop" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1820,i,4324046335799933183,638121885032452658,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1824,i,17393935183204866861,6758751285817654543,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1816 /prefetch:2
  2⤵
  PID:4676
- C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe
  "C:\Users\Admin\AppData\Local\Temp\Notoq Game Center.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\@notoq/desktop" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1820,i,4324046335799933183,638121885032452658,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1824,i,17393935183204866861,6758751285817654543,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2508 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

current.blockmap

Path C:\Users\Admin\AppData\Local\@notoqdesktop-updater\pending\current.blockmap
Size 114KB
SHA256 0ad899868739a4a9232c416d782981e403152aa58cfbd2fd14b2e1d2142aacfb
MD5 e0c5e0d63f10371e605771f2ddfd1d5c
SHA1 94040e979d96299c9803986807562060aa8f4008
SHA512 483dc924cf374b6e4189d2541b40cd037534e320c8ad4ce3588d0ec3d17e6893621432edb32fc6c5f54f650433be84ed89ff5525688eacaec929474ea7157a62
SSDEEP 3072:EIvY/dHplLyIH9moJjJGtd7riW2mWTMyjI+SBi:E0Y/dHvW0MMFGv+W2nljI+l
TLSH
T199B312C41B62C52A537C16D6A24FCD8EE7C89017A196489D0390FE84B95DF4B8CB8F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_o5ybis3o.b4j.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o5ybis3o.b4j.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

96eb05d1-9c9c-4b2a-abda-f2d02e2c1291.tmp

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\96eb05d1-9c9c-4b2a-abda-f2d02e2c1291.tmp
Size 54B
SHA256 aeef9ae170498c52c919f9bf07ab46d45a0fa78a685e345be40207d29adf6ace
MD5 cd2a33ef74950d0c2e037a136cb4dced
SHA1 26292267c8082ed86dd3dc440701f75d50d509d9
SHA512 74eeda213c771928e7e5ea2d9968c275bc6ff1c77b08c0c531f4dfc04dee8d32f7f3ffc0f4dc1a32cc97357c0f54ba077a54b0c03839c4eaea796eee20b45a02
TLSH
T18C90029B242224755A5F1DA54006889A5C6515A0DA0B4B0600D03286897745C088305F
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 beaa96b57e5fb98bad33b73142bc8e3442ab06dbda8a0a3fdf2b6d0e1cdd35ea
MD5 af2b5fa791707578d1e01586e5f1d7d0
SHA1 899201e694b7b1d14983c6e0d7ac2d3de2e445dd
SHA512 94434bd8d853bb16e7a8afd555e9625c421f65b5b246087a81d46536170d5b56277ee46ac8898e768dfb39f7e358f16026275a5e6f6b784644fca62722da4045
MD5 SHA1 SHA512

Submit Download

DIPS

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\DIPS
Size 4KB
SHA256 f1c1d714b195aa1795c50ed2db1795613d868a07340cbf0b1a563384fdfebdcf
MD5 9807cff50448b39728a29115945564b3
SHA1 3f47d1432ce31e76333521af57a5287f08488710
SHA512 e632aea5be889359a4896bb15dbde0a0a4bd34025e4dba23be85b4602507db6ed9766e820a6deb92f56ce3381cb03cb34cf65f52f17109a9fff487c162a0d487
TLSH
T1A8810240538000E1D06806B654A113180A06D29495410B135505008188415440860A84
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\DawnGraphiteCache\index
Size 256KB
SHA256 d9cd0d174d3fc55ad46a67b0c6a779f9b863ffe10a5725098ac8aa032f3094da
MD5 e188e0f99e70dd315d929e8fc98b7098
SHA1 88d61e7814872a1a0d13805286a6630c79a8a027
SHA512 8dcbedaed6e87e36d601829b800facb8dccbbf899e40d80aadbfd6b92955f034d631ab437bc1439f42c90ea8dd94598f9b7ddea2004ebe39886d1220620daeb7
SSDEEP 3:LsOllllklkXltgb//:LsUlP8X
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\DawnWebGPUCache\index
Size 256KB
SHA256 05fb2fc11e8709ec58a3b5378ed82b3a122f28686dd4e70ad5c342a544015ae3
MD5 cb18f9dd973f4f3d127bef81e5ddfd7c
SHA1 e67827516ad4d466fcecf849a81e381d6cd56ea4
SHA512 4d14c1f7dcfa021ee67b24b6cadbb3795e3bf76410eb36e11bf5b340b2739512ac3de29032736472c80bc2f75ab64f46de303b7a21cc69b678a646062359f58a
SSDEEP 3:LsOllllklkXlvju/:LsUlPq
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\GPUCache\index
Size 256KB
SHA256 38f1a78106b6162c9dbd150dfe489d130ffd612c6fd497e846dbe27accb0bbfc
MD5 77d94ef996111f931fa24eb4b16dde04
SHA1 6a5db41c35dec977aa0c8e02e4a951940438e0fc
SHA512 bce60bee1fdd48a19e7701ae64106e6cc5fbacf04c754ca289e0fa87694edb0a6cf4febdfb33b08d4229575c0df9918d2a1d09f640ab19c8687ee4d239ec1af4
SSDEEP 3:LsOllllklkXlfh9QKlll/:LsUlPJ9Qe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\Local State
Size 490B
SHA256 d30e0731129dc07e8e7f665960711188bb0197f0048c650708e9c836a500aa12
MD5 a3da39ad41ed7a8d477e07a3043b917e
SHA1 923107f2e02aa33f235703770c7994ee405d78fb
SHA512 35dd65f1835d005d3c02c1d2f3acb0895aa44b8c7ea6c58a18a1dee516a936c8874be60727c31853776bf313cc591f7ef60dd91986372f90aac9f091ba63a1ca
TLSH
T19CF09EB16CB47E686D30425C170EBB560D251B7381246E05E95E242302B3CD5AB0ED31
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\Network\Trust Tokens
Size 36KB
SHA256 96c6bb59ca9c0e33bc09bf2d28b682e1785ee5c6d4f6d15cee322833cc643143
MD5 350f2b2f686ca898b7cc748460cafba0
SHA1 3b2c0cb733bf705605ed39ad4d38df703127ae79
SHA512 9a806f952c54c8430806ca6290b0100fb6722bc87efa02bc56369147a3f7b3ca32d6168b71cfa0d8b262ee23ac1a0710a298542628cf1423f298b7b1607e18c9
SSDEEP 24:TL+3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TK31DtX5nDOvyKDhU1cSB
TLSH
T195F2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055EB443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 3f9d763b0013f5bf43727c352d32ad6ab53bf387f254e9ea609e5cb88dfe421c
MD5 01883c5d17c095531b7d5147dca8831d
SHA1 57c5bbd2c59932175ba8f161e99757085b58dabc
SHA512 5223640ba15bab7cb618959d3c10e453ce3d2261b5c476afa57007df0699184df29ddd84c527759b3790f489d11956ce502a4fc5179bf669b8387645686f1ee6
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\Shared Dictionary\db
Size 44KB
SHA256 b87da9786c3fb75b92ca41e78f7a8cacba24040a26ad85674782ad2cbf5ad814
MD5 5dcb9d49a72cdb13e07a9d084e7433cc
SHA1 2489f726263c22e6fc899c85b458ad2e9fbcf04d
SHA512 7564e3173d3171959ff75597bc501abf9762e8e311e10a18e44a8bb96da160e1ebd721fa5fe45e77d3755194dda6f89a7eb0adb026e37658588678bd16b5f1c8
SSDEEP 24:TL6zgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:T/OIy4m1b3fbUdeqSB
TLSH
T19613DB0F1E187550D1BD0235E8E24E6B2E7E200C9B8329D125F01AF24DE211C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gamecenter.json

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\gamecenter.json
Size 1KB
SHA256 368f0f7554213185b0d6fe902629fca8c40e3433b928e9ec61388370083c7b36
MD5 8b4b3ec0a66dac094a9783cb5b02570c
SHA1 3004ca8c4ec1505acda860c9ef7ffce89411986e
SHA512 5ccb1ed5d0ec9b43eaae4eb171e294acada032ac691707e1f4b0ce33031ab59e0f66a15323e4d84c595dbaf97c0d438a421087e66be59af17a53a95bc300b095
TLSH
T1E6313625C8790CB712D5A17A5C7E6213B73488874D543A2CBA5F8A6C0F0D72F31B67E9
MD5 SHA1 SHA512 TLSH

Submit Download

gamecenter.json

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\gamecenter.json
Size 1KB
SHA256 b9391bb3204519d553d072dc3e5083f40ee043b836086c1d1e33c980553498d5
MD5 592f922184fa30b2cd5d8b80f9d4c881
SHA1 af0c84eeba1f04a61a4e06a4436cda917a6b12c1
SHA512 25cbd2ca96d081f62368e9a199c622fdc6903c845f14257845ef9f9598e2845463b30b3cc70922f12e45a857adb7333df5656e674624034595d8a740e2037ffd
TLSH
T19B315624C8790CB712C5A17A5C7E6213B73488874D453A2CBA5F8A6C0F0DB2F31B67E9
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\de-DE\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1396-144-0x000001CB45510000-0x000001CB45614000-memory.dmp

Download

memory/1396-115-0x000001CB450E0000-0x000001CB45102000-memory.dmp

Download

memory/1396-114-0x000001CB2C580000-0x000001CB2C590000-memory.dmp

Download

memory/1396-104-0x000001CB45170000-0x000001CB451F6000-memory.dmp

Download

memory/3572-227-0x00000281CB8F0000-0x00000281CB8F1000-memory.dmp

Download

memory/3572-226-0x00000281CB8F0000-0x00000281CB8F1000-memory.dmp

Download

memory/3572-225-0x00000281CB8F0000-0x00000281CB8F1000-memory.dmp

Download

memory/3572-231-0x00000281CB8F0000-0x00000281CB8F1000-memory.dmp

Download

memory/3572-233-0x00000281CB8F0000-0x00000281CB8F1000-memory.dmp

Download

memory/3572-237-0x00000281CB8F0000-0x00000281CB8F1000-memory.dmp

Download

memory/3572-236-0x00000281CB8F0000-0x00000281CB8F1000-memory.dmp

Download

memory/3572-235-0x00000281CB8F0000-0x00000281CB8F1000-memory.dmp

Download

memory/3572-234-0x00000281CB8F0000-0x00000281CB8F1000-memory.dmp

Download

memory/3572-232-0x00000281CB8F0000-0x00000281CB8F1000-memory.dmp

Download

memory/3784-205-0x00000211AF7D0000-0x00000211AF9EC000-memory.dmp

Download