Trojan.Siggen32.27031

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM chrome.exe
'<SYSTEM32>\taskkill.exe' /F /IM msedge.exe
'<SYSTEM32>\taskkill.exe' /F /IM brave.exe
'<SYSTEM32>\taskkill.exe' /F /IM firefox.exe
'<SYSTEM32>\taskkill.exe' /F /IM opera.exe
'<SYSTEM32>\taskkill.exe' /F /IM kometa.exe
'<SYSTEM32>\taskkill.exe' /F /IM orbitum.exe
'<SYSTEM32>\taskkill.exe' /F /IM centbrowser.exe
'<SYSTEM32>\taskkill.exe' /F /IM 7star.exe
'<SYSTEM32>\taskkill.exe' /F /IM sputnik.exe
'<SYSTEM32>\taskkill.exe' /F /IM vivaldi.exe
'<SYSTEM32>\taskkill.exe' /F /IM epicprivacybrowser.exe
'<SYSTEM32>\taskkill.exe' /F /IM uran.exe
'<SYSTEM32>\taskkill.exe' /F /IM yandex.exe
'<SYSTEM32>\taskkill.exe' /F /IM iridium.exe

Launches a large number of processes

Injects code into

the following user processes:

fxsound.exe

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\windowspowershell\v1.0\powershell.exe

the following user processes:

firefox.exe

Modifies file system

Creates the following files

%TEMP%\nstd3bc.tmp\system.dll
%TEMP%\nstd3bc.tmp\stdutils.dll
%TEMP%\nstd3bc.tmp\spiderbanner.dll
%TEMP%\nstd3bc.tmp\nsexec.dll
%TEMP%\nstd3bc.tmp\app-64.7z
%TEMP%\nstd3bc.tmp\nsis7z.dll
%TEMP%\nstd3bc.tmp\7z-out\chrome_100_percent.pak
%TEMP%\nstd3bc.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nstd3bc.tmp\7z-out\icudtl.dat
%TEMP%\nstd3bc.tmp\7z-out\license.electron.txt
%TEMP%\nstd3bc.tmp\7z-out\licenses.chromium.html
%TEMP%\nstd3bc.tmp\7z-out\locales\af.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\am.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ar.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\bg.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\bn.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ca.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\cs.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\da.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\de.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\el.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\en-gb.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\en-us.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\es-419.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\es.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\et.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\fa.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\fi.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\fil.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\fr.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\gu.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\he.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\hi.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\hr.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\hu.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\id.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\it.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ja.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\kn.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ko.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\lt.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\lv.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ml.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\mr.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ms.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\nb.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\nl.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\pl.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\pt-br.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ro.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ru.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\sk.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\sl.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\sr.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\sv.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\sw.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ta.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\te.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\th.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\tr.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\uk.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ur.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\vi.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\dist\index.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\license
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\package.json
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\node.napi.node
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\dpapi_addon.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\dpapi_not_supported.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\dpapi_win.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\main.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\build\release\better_sqlite3.node
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\common.gypi
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\copy.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\defines.gypi
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\download.sh
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\patches\1208.patch
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3.c
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3ext.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3.gyp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\test_extension.c
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\database.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\index.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\aggregate.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\backup.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\function.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\inspect.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\pragma.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\serialize.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\table.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\transaction.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\wrappers.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\util.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\license
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\package.json
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\addon.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\better_sqlite3.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\backup.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\backup.hpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\database.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\database.hpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement-iterator.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement-iterator.hpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement.hpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\bind-map.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\binder.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\constants.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\custom-aggregate.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\custom-function.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\custom-table.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\data-converter.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\data.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\helpers.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\macros.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\query-macros.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\row-builder.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\build\release\node_sqlite3.node
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\common-sqlite.gypi
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\extract.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\sqlite-autoconf-3440200.tar.gz
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\sqlite3.gyp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\lib\sqlite3-binding.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\lib\sqlite3.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\lib\trace.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\license
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\package.json
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\async.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\backup.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\database.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\gcc-preinclude.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\macros.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\statement.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\threading.h
%TEMP%\nstd3bc.tmp\7z-out\resources.pak
%TEMP%\nstd3bc.tmp\7z-out\snapshot_blob.bin
%TEMP%\nstd3bc.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nstd3bc.tmp\7z-out\vk_swiftshader_icd.json
%TEMP%\nstd3bc.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nstd3bc.tmp\7z-out\ffmpeg.dll
%TEMP%\nstd3bc.tmp\7z-out\fxsound.exe
%TEMP%\nstd3bc.tmp\7z-out\libegl.dll
%TEMP%\nstd3bc.tmp\7z-out\libglesv2.dll
%TEMP%\nstd3bc.tmp\7z-out\resources\elevate.exe
%TEMP%\nstd3bc.tmp\7z-out\vk_swiftshader.dll
%TEMP%\nstd3bc.tmp\7z-out\vulkan-1.dll
%LOCALAPPDATA%\programs\fxsound\chrome_100_percent.pak
%LOCALAPPDATA%\programs\fxsound\chrome_200_percent.pak
%LOCALAPPDATA%\programs\fxsound\d3dcompiler_47.dll
%LOCALAPPDATA%\programs\fxsound\ffmpeg.dll
%LOCALAPPDATA%\programs\fxsound\fxsound.exe
%LOCALAPPDATA%\programs\fxsound\icudtl.dat
%LOCALAPPDATA%\programs\fxsound\libegl.dll
%LOCALAPPDATA%\programs\fxsound\libglesv2.dll
%LOCALAPPDATA%\programs\fxsound\license.electron.txt
%LOCALAPPDATA%\programs\fxsound\licenses.chromium.html
%LOCALAPPDATA%\programs\fxsound\resources.pak
%LOCALAPPDATA%\programs\fxsound\snapshot_blob.bin
%LOCALAPPDATA%\programs\fxsound\v8_context_snapshot.bin
%LOCALAPPDATA%\programs\fxsound\vk_swiftshader.dll
%LOCALAPPDATA%\programs\fxsound\vk_swiftshader_icd.json
%LOCALAPPDATA%\programs\fxsound\vulkan-1.dll
%LOCALAPPDATA%\programs\fxsound\locales\af.pak
%LOCALAPPDATA%\programs\fxsound\locales\am.pak
%LOCALAPPDATA%\programs\fxsound\locales\ar.pak
%LOCALAPPDATA%\programs\fxsound\locales\bg.pak
%LOCALAPPDATA%\programs\fxsound\locales\bn.pak
%LOCALAPPDATA%\programs\fxsound\locales\ca.pak
%LOCALAPPDATA%\programs\fxsound\locales\cs.pak
%LOCALAPPDATA%\programs\fxsound\locales\da.pak
%LOCALAPPDATA%\programs\fxsound\locales\de.pak
%LOCALAPPDATA%\programs\fxsound\locales\el.pak
%LOCALAPPDATA%\programs\fxsound\locales\en-gb.pak
%LOCALAPPDATA%\programs\fxsound\locales\en-us.pak
%LOCALAPPDATA%\programs\fxsound\locales\es-419.pak
%LOCALAPPDATA%\programs\fxsound\locales\es.pak
%LOCALAPPDATA%\programs\fxsound\locales\et.pak
%LOCALAPPDATA%\programs\fxsound\locales\fa.pak
%LOCALAPPDATA%\programs\fxsound\locales\fi.pak
%LOCALAPPDATA%\programs\fxsound\locales\fil.pak
%LOCALAPPDATA%\programs\fxsound\locales\fr.pak
%LOCALAPPDATA%\programs\fxsound\locales\gu.pak
%LOCALAPPDATA%\programs\fxsound\locales\he.pak
%LOCALAPPDATA%\programs\fxsound\locales\hi.pak
%LOCALAPPDATA%\programs\fxsound\locales\hr.pak
%LOCALAPPDATA%\programs\fxsound\locales\hu.pak
%LOCALAPPDATA%\programs\fxsound\locales\id.pak
%LOCALAPPDATA%\programs\fxsound\locales\it.pak
%LOCALAPPDATA%\programs\fxsound\locales\ja.pak
%LOCALAPPDATA%\programs\fxsound\locales\kn.pak
%LOCALAPPDATA%\programs\fxsound\locales\ko.pak
%LOCALAPPDATA%\programs\fxsound\locales\lt.pak
%LOCALAPPDATA%\programs\fxsound\locales\lv.pak
%LOCALAPPDATA%\programs\fxsound\locales\ml.pak
%LOCALAPPDATA%\programs\fxsound\locales\mr.pak
%LOCALAPPDATA%\programs\fxsound\locales\ms.pak
%LOCALAPPDATA%\programs\fxsound\locales\nb.pak
%LOCALAPPDATA%\programs\fxsound\locales\nl.pak
%LOCALAPPDATA%\programs\fxsound\locales\pl.pak
%LOCALAPPDATA%\programs\fxsound\locales\pt-br.pak
%LOCALAPPDATA%\programs\fxsound\locales\pt-pt.pak
%LOCALAPPDATA%\programs\fxsound\locales\ro.pak
%LOCALAPPDATA%\programs\fxsound\locales\ru.pak
%LOCALAPPDATA%\programs\fxsound\locales\sk.pak
%LOCALAPPDATA%\programs\fxsound\locales\sl.pak
%LOCALAPPDATA%\programs\fxsound\locales\sr.pak
%LOCALAPPDATA%\programs\fxsound\locales\sv.pak
%LOCALAPPDATA%\programs\fxsound\locales\sw.pak
%LOCALAPPDATA%\programs\fxsound\locales\ta.pak
%LOCALAPPDATA%\programs\fxsound\locales\te.pak
%LOCALAPPDATA%\programs\fxsound\locales\th.pak
%LOCALAPPDATA%\programs\fxsound\locales\tr.pak
%LOCALAPPDATA%\programs\fxsound\locales\uk.pak
%LOCALAPPDATA%\programs\fxsound\locales\ur.pak
%LOCALAPPDATA%\programs\fxsound\locales\vi.pak
%LOCALAPPDATA%\programs\fxsound\locales\zh-cn.pak
%LOCALAPPDATA%\programs\fxsound\locales\zh-tw.pak
%LOCALAPPDATA%\programs\fxsound\resources\app.asar
%LOCALAPPDATA%\programs\fxsound\resources\elevate.exe
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\@primno\dpapi\license
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\@primno\dpapi\package.json
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\@primno\dpapi\dist\index.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\node.napi.node
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\dpapi_addon.h
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\dpapi_not_supported.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\dpapi_win.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\main.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\license
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\package.json
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\build\release\better_sqlite3.node
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\common.gypi
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\copy.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\defines.gypi
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\download.sh
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3.gyp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\test_extension.c
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\patches\1208.patch
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3.c
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3.h
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3ext.h
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\database.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\index.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\util.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\aggregate.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\backup.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\function.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\inspect.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\pragma.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\serialize.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\table.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\transaction.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\wrappers.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\addon.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\better_sqlite3.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\backup.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\backup.hpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\database.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\database.hpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement-iterator.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement-iterator.hpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement.hpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\bind-map.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\binder.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\constants.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\custom-aggregate.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\custom-function.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\custom-table.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\data-converter.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\data.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\helpers.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\macros.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\query-macros.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\row-builder.cpp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\sqlite3\license
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\sqlite3\package.json
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\sqlite3\build\release\node_sqlite3.node
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\sqlite3\deps\common-sqlite.gypi
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\sqlite3\deps\extract.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\sqlite3\deps\sqlite-autoconf-3440200.tar.gz
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\sqlite3\deps\sqlite3.gyp
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\sqlite3\lib\sqlite3-binding.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\sqlite3\lib\sqlite3.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\sqlite3\lib\trace.js
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\sqlite3\src\async.h
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\sqlite3\src\backup.h
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\sqlite3\src\database.h
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\sqlite3\src\gcc-preinclude.h
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\sqlite3\src\macros.h
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\sqlite3\src\statement.h
%LOCALAPPDATA%\programs\fxsound\resources\app.asar.unpacked\node_modules\sqlite3\src\threading.h
%LOCALAPPDATA%\fxsound-updater\installer.exe
%LOCALAPPDATA%\programs\fxsound\uninstall fxsound.exe
%APPDATA%\microsoft\windows\start menu\programs\fxsound.lnk
%TEMP%\nstd3bc.tmp\winshell.dll
%HOMEPATH%\desktop\fxsound.lnk
%APPDATA%\fxsound\d3ffcabc-ff1a-4606-b270-2a6f271018d3.tmp
%TEMP%\hsperfdata_user\4284
%ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\helium\cache\fbe763a1dba895b6.dat
%LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\systemappdata\helium\user.dat.log1
%LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\systemappdata\helium\user.dat
%LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\systemappdata\helium\userclasses.dat.log1
%LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\systemappdata\helium\userclasses.dat
%ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\helium\cache\fbe763a1dba895b6_com15.dat.log1
%ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\helium\cache\fbe763a1dba895b6_com15.dat
%TEMP%\hsperfdata_user\5476

Deletes following files that it created itself

%TEMP%\nstd3bc.tmp\7z-out\chrome_100_percent.pak
%TEMP%\nstd3bc.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nstd3bc.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nstd3bc.tmp\7z-out\ffmpeg.dll
%TEMP%\nstd3bc.tmp\7z-out\fxsound.exe
%TEMP%\nstd3bc.tmp\7z-out\icudtl.dat
%TEMP%\nstd3bc.tmp\7z-out\libegl.dll
%TEMP%\nstd3bc.tmp\7z-out\libglesv2.dll
%TEMP%\nstd3bc.tmp\7z-out\license.electron.txt
%TEMP%\nstd3bc.tmp\7z-out\licenses.chromium.html
%TEMP%\nstd3bc.tmp\7z-out\locales\af.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\am.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ar.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\bg.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\bn.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ca.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\cs.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\da.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\de.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\el.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\en-gb.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\en-us.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\es-419.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\es.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\et.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\fa.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\fi.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\fil.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\fr.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\gu.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\he.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\hi.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\hr.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\hu.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\id.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\it.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ja.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\kn.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ko.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\lt.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\lv.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ml.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\mr.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ms.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\nb.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\nl.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\pl.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\pt-br.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ro.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ru.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\sk.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\sl.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\sr.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\sv.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\sw.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ta.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\te.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\th.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\tr.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\uk.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\ur.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\vi.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nstd3bc.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\dist\index.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\license
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\package.json
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\node.napi.node
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\dpapi_addon.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\dpapi_not_supported.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\dpapi_win.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\main.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\build\release\better_sqlite3.node
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\common.gypi
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\copy.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\defines.gypi
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\download.sh
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\patches\1208.patch
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3.c
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3ext.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3.gyp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\test_extension.c
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\database.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\index.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\aggregate.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\backup.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\function.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\inspect.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\pragma.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\serialize.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\table.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\transaction.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\wrappers.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\util.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\license
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\package.json
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\addon.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\better_sqlite3.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\backup.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\backup.hpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\database.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\database.hpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement-iterator.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement-iterator.hpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement.hpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\bind-map.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\binder.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\constants.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\custom-aggregate.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\custom-function.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\custom-table.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\data-converter.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\data.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\helpers.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\macros.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\query-macros.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\row-builder.cpp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\build\release\node_sqlite3.node
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\common-sqlite.gypi
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\extract.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\sqlite-autoconf-3440200.tar.gz
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\sqlite3.gyp
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\lib\sqlite3-binding.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\lib\sqlite3.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\lib\trace.js
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\license
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\package.json
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\async.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\backup.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\database.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\gcc-preinclude.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\macros.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\statement.h
%TEMP%\nstd3bc.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\threading.h
%TEMP%\nstd3bc.tmp\7z-out\resources\elevate.exe
%TEMP%\nstd3bc.tmp\7z-out\resources.pak
%TEMP%\nstd3bc.tmp\7z-out\snapshot_blob.bin
%TEMP%\nstd3bc.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nstd3bc.tmp\7z-out\vk_swiftshader.dll
%TEMP%\nstd3bc.tmp\7z-out\vk_swiftshader_icd.json
%TEMP%\nstd3bc.tmp\7z-out\vulkan-1.dll
%TEMP%\nstd3bc.tmp\app-64.7z
%TEMP%\nstd3bc.tmp\nsexec.dll
%TEMP%\nstd3bc.tmp\nsis7z.dll
%TEMP%\nstd3bc.tmp\spiderbanner.dll
%TEMP%\nstd3bc.tmp\stdutils.dll
%TEMP%\nstd3bc.tmp\system.dll
%TEMP%\nstd3bc.tmp\winshell.dll

Moves the following files

from %APPDATA%\fxsound\d3ffcabc-ff1a-4606-b270-2a6f271018d3.tmp to %APPDATA%\fxsound\local state

Modifies the following files

%HOMEPATH%\.oracle_jre_usage\90737d32e3aba6b.timestamp

Network activity

Connects to

'dn#.google':443
'ip##pi.com':80

TCP

HTTP GET requests

http://ip##pi.com/json/

Other

'dn#.google':443

UDP

DNS ASK dn#.google
DNS ASK ip##pi.com

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''
ClassName: 'SysListView32' WindowName: ''
ClassName: '' WindowName: ''

Creates and executes the following

'%LOCALAPPDATA%\programs\fxsound\fxsound.exe'
'%LOCALAPPDATA%\programs\fxsound\fxsound.exe' --type=gpu-process --user-data-dir="%APPDATA%\fxsound" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgA...
'%LOCALAPPDATA%\programs\fxsound\fxsound.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\fxsound" --mojo-platform-channel-handle=1768 --field-trial-han...

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq FxSound.exe" /FO csv | "<SYSTEM32>\find.exe" "FxSound.exe"
'%WINDIR%\syswow64\tasklist.exe' /FI "USERNAME eq user" /FI "IMAGENAME eq FxSound.exe" /FO csv
'%WINDIR%\syswow64\find.exe' "FxSound.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "chcp"
'<SYSTEM32>\chcp.com'
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM chrome.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM msedge.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM brave.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM firefox.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM opera.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM kometa.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM orbitum.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM centbrowser.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM 7star.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM sputnik.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM vivaldi.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM uran.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM yandex.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM iridium.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
'<SYSTEM32>\cmd.exe' /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackM...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
'<SYSTEM32>\cmd.exe' /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
'<SYSTEM32>\findstr.exe' /C:"Detected boot environment" "%WINDIR%\Panther\setupact.log"
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -Command "(Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey""
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "(Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey"
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Desc...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContin...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -joi...
'<SYSTEM32>\cmd.exe' /d /s /c "netsh wlan show profiles"
'<SYSTEM32>\netsh.exe' wlan show profiles
'<SYSTEM32>\cmd.exe' /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
'<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
'<SYSTEM32>\cmd.exe' /d /s /c "openssl version"
'<SYSTEM32>\cmd.exe' /d /s /c "npm -v"
'<SYSTEM32>\cmd.exe' /d /s /c "pm2.cmd -v"
'<SYSTEM32>\cmd.exe' /d /s /c "yarn --version"
'<SYSTEM32>\cmd.exe' /d /s /c "gulp.cmd --version"
'<SYSTEM32>\cmd.exe' /d /s /c "brew --version"
'<SYSTEM32>\cmd.exe' /d /s /c "tsc.cmd --version"
'<SYSTEM32>\cmd.exe' /d /s /c "grunt.cmd --version"
'<SYSTEM32>\cmd.exe' /d /s /c "git --version"
'<SYSTEM32>\cmd.exe' /d /s /c "apachectl -v 2>&1"
'<SYSTEM32>\cmd.exe' /d /s /c "nginx -v 2>&1"
'<SYSTEM32>\cmd.exe' /d /s /c "mysql -V"
'<SYSTEM32>\cmd.exe' /d /s /c "php -v"
'<SYSTEM32>\cmd.exe' /d /s /c "redis-server --version"
'<SYSTEM32>\cmd.exe' /d /s /c "docker --version"
'<SYSTEM32>\cmd.exe' /d /s /c "postconf -d | grep mail_version"
'<SYSTEM32>\cmd.exe' /d /s /c "mongod --version"
'<SYSTEM32>\cmd.exe' /d /s /c "perl -v"
'<SYSTEM32>\cmd.exe' /d /s /c "python -V 2>&1"
'<SYSTEM32>\cmd.exe' /d /s /c "python3 -V 2>&1"
'<SYSTEM32>\cmd.exe' /d /s /c "pip -V 2>&1"
'<SYSTEM32>\cmd.exe' /d /s /c "pip3 -V 2>&1"
'<SYSTEM32>\cmd.exe' /d /s /c "java -version 2>&1"
'<SYSTEM32>\cmd.exe' /d /s /c "gcc -dumpversion"
'<SYSTEM32>\cmd.exe' /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"
'<SYSTEM32>\cmd.exe' /d /s /c "bash --version"
'<SYSTEM32>\cmd.exe' /d /s /c "zsh --version"
'<SYSTEM32>\cmd.exe' /d /s /c "fish --version"
'<SYSTEM32>\cmd.exe' /d /s /c "bun -v"
'<SYSTEM32>\cmd.exe' /d /s /c "deno -v"
'<SYSTEM32>\cmd.exe' /d /s /c "node -v"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSCh...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,Executabl...
'%ProgramFiles%\windowsapps\microsoft.desktopappinstaller_1.0.30251.0_x64__8wekyb3d8bbwe\appinstallerpythonredirector.exe' -V
'<SYSTEM32>\cmd.exe' /d /s /c "gcc --version"
'<SYSTEM32>\cmd.exe' /d /s /c "wmic product get name,version,vendor,installDate /format:list"
'<SYSTEM32>\wbem\wmic.exe' product get name,version,vendor,installDate /format:list
'<SYSTEM32>\cmd.exe' /d /s /c "ipconfig /all"
'<SYSTEM32>\ipconfig.exe' /all
'<SYSTEM32>\cmd.exe' /d /s /c "route print"
'<SYSTEM32>\route.exe' print
'<SYSTEM32>\cmd.exe' /d /s /c "wmic service get name,displayName,state,startMode,pathName /format:list"
'<SYSTEM32>\wbem\wmic.exe' service get name,displayName,state,startMode,pathName /format:list
'%WINDIR%\syswow64\cmd.exe' /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq FxSound.exe" /FO csv | "<SYSTEM32>\find.exe" "FxSound.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "chcp"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM chrome.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM msedge.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM brave.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM firefox.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM opera.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM kometa.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM orbitum.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM centbrowser.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM 7star.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM sputnik.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM vivaldi.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM epicprivacybrowser.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM uran.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM yandex.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM iridium.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackM...' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -Command "(Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey""' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Desc...' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContin...' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -joi...' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "netsh wlan show profiles"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "openssl version"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "npm -v"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "pm2.cmd -v"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "yarn --version"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "gulp.cmd --version"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "brew --version"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "tsc.cmd --version"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "grunt.cmd --version"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "git --version"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "apachectl -v 2>&1"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "nginx -v 2>&1"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "mysql -V"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "php -v"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "redis-server --version"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "docker --version"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "postconf -d | grep mail_version"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "mongod --version"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "perl -v"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "python -V 2>&1"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "python3 -V 2>&1"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "pip -V 2>&1"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "pip3 -V 2>&1"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "java -version 2>&1"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "gcc -dumpversion"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "bash --version"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "zsh --version"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "fish --version"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "bun -v"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "deno -v"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "node -v"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSCh...' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,Executabl...' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "gcc --version"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic product get name,version,vendor,installDate /format:list"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "ipconfig /all"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "route print"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic service get name,displayName,state,startMode,pathName /format:list"' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial